SUBCOURSE 

IT0735 


EDITION 

C 


US ARMY INTELLIGENCE CENTER 


COUNTERINTELLIGENCE 

INVESTIGATIONS 











COUNTERINTELLIGENCE INVESTIGATIONS 


Subcourse Number: IT0735 
EDITION C 

U.S. Army Intelligence Center 
Fort Huachuca, AZ 85613-6000 

6 Credit Hours 

Edition Date: February 1998 
SUBCOURSE OVERVIEW 

This subcourse is designed to teach you, the counterintelligence (Cl) Special 
Agent, the rationale and doctrine concerning the authority, jurisdiction, and scope 
for initiating all Cl cases; the proper procedures for the conduct of selected Cl 
investigations; and the recommended techniques for the handling of physical 
evidence. 

There are no prerequisites for this subcourse. 

This subcourse reflects the doctrine which was current at the time the subcourse 
was prepared. In your own work situation, always refer to the latest publications. 

The words "he," "him', "his," and "men", when used in this publication, represent 
both the masculine and feminine genders unless otherwise stated. 

TERMINAL LEARNING OBJECTIVE 

ACTION: You will identify the purpose, scope, jurisdiction, as well as the 

administrative responsibilities, authority, and functions for all Cl 
investigations; learn proper procedures for the conduct of 
complaint-type investigations (CTI); and, when applicable, initiate 
and coordinate the collection of physical evidence for possible use 
in judicial proceedings. 

CONDITIONS: Given narrative information and illustrations from FM 34-60, FM 34- 

60A(S), FM 19-20 and AR 380-67, AR 381-20, and AR 195-2. 

STANDARDS: To demonstrate competency of this task, you must achieve a minimum 

of 70% on the subcourse examination. 

** NOTE** The Defense Investigative Service (DIS), is now the Defense Security 
Service DSS. This change will be made in the subcourse when it is revised. 


i 


IT0735 



TABLE OF CONTENTS 


Section Page 

Subcourse Overview. i 

Lesson 1: Cl INVESTIGATIONS: PURPOSE, SCOPE, JURISDICTION, AND 

AUTHORITY. 1-1 

PART A: Purpose, Scope, Jurisdiction and Authority for . 1-2 

Cl Investigations 

PART B: Source of Investigation Requests, Control Offices, 

and Functions of CCF. 1-4 

Practice Exercise. 1-11 

Answer Key and Feedback. 1-14 

Lesson 2: CONDUCT Cl INVESTIGATIONS OF SABOTAGE,. 2-1 

ESPIONAGE, TREASON, SEDITION, AND SUBVERSION 

Part A: Sabotage. 2-2 

Part B: Espionage. 2-11 

Part C: Treason. 2-14 

Part D: Sedition. 2-16 

Part E: Subversion. 2-18 

Practice Exercise. 2-21 

Answer Key and Feedback. 2-24 

Lesson 3: PHYSICAL EVIDENCE. 3-1 

Part A: Physical Evidence of Cl Significance. 3-2 

Part B: Account For, Store, Release, and Dispose. 3-4 

of Evidence 

Practice Exercise. 3-23 

Answer Key and Feedback. 3-24 


IT0735 


li 























Appendix A: Crime Scene Processing. A-l 

Appendix B: Transmittal of Evidence. B-l 

Appendix C: Acronyms. C-l 


iii 


IT0735 







LESSON 1 


Cl INVESTIGATIONS: PURPOSE, SCOPE, 
JURISDICTION AND AUTHORITY 


CRITICAL TASK: NONE 
OVERVIEW 


LESSON DESCRIPTION: 

In this lesson, you will learn the rationale and applicable doctrine concerning the 
conduct of counterintelligence (Cl) investigations to include the authority, 
jurisdictional constraints, scope, and the administrative functions for all phases 
of an investigation. 

TERMINAL LEARNING OBJECTIVE: 

ACTIONS: Describe the functions of the Personnel Security Central Clearance 

Facility (CCF) and other applicable control offices; identify and 
perform the administrative responsibilities for all phases of a Cl 
investigation; and state the doctrine, scope criteria, and purpose 
for the initiation of an investigation. 

CONDITIONS: You will be given narrative information and illustrations from FM 

34-60 . 

STANDARD: You will initiate, perform all administrative functions, and properly 

record the results of both favorable and unfavorable Cl 
investigations IAW with the provisions of FM 34-60. 

REFERENCES: The material contained in this lesson was derived from the following 

publications: 

AR 380-5, 

AR 381-10, 

AR 381-20, 

AR 380-67, 

FM 34-60, 
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This lesson has two parts: 

Part A: Purpose, Scope, Jurisdiction and Authority for Cl investigations. 

Part B: Source of Investigation Requests, Control Offices, and Function of The 

Personnel Security Central Clearance Facility (CCF). 

PART A: PURPOSE, SCOPE, JURISDICTION AND AUTHORITY 
FOR Cl INVESTIGATIONS 

PURPOSE OF Cl INVESTIGATIONS . Cl investigations are aimed at the detection, 
prevention, and neutralization of actual or potential threats to the security of 
the command and the Army, regardless of whether criminal activity is involved. 
Although prosecution of the offenders may be the natural consequence of some Cl 
investigations, the primary objective is the security of the command. Many 
operations of Cl units must be coordinated carefully with those of military police 
(MP) investigative units and other intelligence and security agencies. This 
coordination will prevent operations of one agency from having a negative effect on 
or compromising the operations of another. 

SCOPE OF INVESTIGATIONS . It is Department of the Army (DA) policy that a Cl 
investigation will be limited in scope to the minimum amount of assets necessary to 
obtain adequate information on which to base an adjudication or decision. Special 
care and minimum use of covert investigative techniques will be used, particularly 
when authorized to investigate nonaffiliated United States (US) citizens and 
organizations. When the use of such techniques is contemplated, the legal officers 
of the US Army Intelligence and Security Command (INSCOM) must be consulted to 
ensure the action is in conformance with Army Regulations (AR), federal statutes, 
and if applicable, the laws of the host foreign country. When any legal doubt 
exists, prior approval must be requested from the Deputy Chief of Staff for 
Intelligence, DA (DCSINT, DA). 
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All Cl investigators and supervisors must understand that a legal distinction 
exists between an investigation involving foreign intelligence agencies and a 
routine investigation involving US citizens or allied foreign nationals. As a 
general rule, use of covert techniques is prohibited in routine investigations 
involving citizens of the US or allied foreign nations. 

Information developed during the course of any Cl investigation that indicates 
involvement by a foreign intelligence service must be reported by the fastest 
secure means available, consistent with the "need to know" principles, to Army Case 
Control Officer (ACCO). 

ARMY JURISDICTION . An agreement was entered into in 1949 by DCSINT, DA; the Office 
of Naval Criminal Investigative Service (NCIS) US Navy; the Office of Special 
Investigations, (OSI), Inspector General, US Air Force; and the Federal Bureau of 
Investigation (FBI). This agreement is commonly known as the "Delimitations 
Agreement". It establishes the responsibilities of the signatories for 
investigating all activities coming under the categories of espionage, 
counterespionage, criminal subversion, and sabotage. This agreement is binding 
upon all US Army investigative agencies. 

NOTE: ONI has been redesignated as the Naval Criminal Investigative Service (NCIS). 

DCSINT, DA is responsible for: 

* The investigation and disposal of all cases of espionage, 
counterespionage, criminal subversion, and sabotage involving active and 
retired Army military personnel. 

* The disposal, but not investigation, of all cases in these categories 
involving Army civilian employees in the US, Puerto Rico, and the Virgin 
Islands. 

* The investigation and disposal of all cases in these categories involving 
Army civilian employees stationed in areas other than the US, Puerto Rico, 
and the Virgin Islands, except part of such investigations as have 
ramifications in the US, Puerto Rico, or the Virgin Islands. 

* The investigation of all cases in these categories involving civilians and 
foreign nationals who are not employees of the other subscribing 
organizations, in areas where the Army commander has supreme jurisdiction 
over the Armed Forces stationed therein, including possessions of the US 
other than Puerto Rico and the Virgin Islands. 

* Informing the other subscribing organizations of any important 
developments. 
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PART B: SOURCE OF INVESTIGATION REQUESTS 
CONTROL OFFICES, AND FUNCTION OF CCF 


SOURCE OF INVESTIGATION REQUESTS . The mission of Cl elements and units is "the 
detection, identification, assessment, counter, neutralize, or exploit threat 
intelligence collection efforts. 

In fulfillment of this mission. Cl personnel and units engage in a broad range of 
operations with direction and guidance from higher authorities within their areas 
of operations. Some of those activities which may be termed "force protection", 
include the following: 

* Safeguarding defense information. 

* Assessing vulnerabilities and recommending solutions for Army facilities 
which have classified defense contracts or have been designated as key 
defense installations. 

* Conducting Cl surveys, inspections and services. 

* Conducting two types of investigations. 

* Cl Investigations (Aka: SAEDA) and personnel security investigations 
(PSI) . 

A Counterintelligence Investigation (CII) is one in which sabotage, espionage, 
spying, treason, sedition, or subversion, FIS directed sabotage, activity is 
suspected or alleged because of the receipt or development of credible derogatory 
information. The primary purpose of each CII is to identify, neutralize and 
exploit information of such a nature form and reliability that may determine the 
extent and nature of action, if any, is necessary to counteract the threat and 
enhance security. CII may have various origins, but generally originate from four 
common sources: 

Signal Scope Background Investigation ( SSBI ). During the conduct of a routine SSBI 
by the Defense Investigative Service (DIS), credible derogatory information 
reflecting on subject's lovaltv is investigated. 

As a result, the investigation classification will be changed from that of a SSBI 

to CII. DIS will dispose of the case IAW its charter. Department of Defense (DOD) 

Directive 5105.42. DIS has the option to run the investigation or refer the case 
to the appropriate investigative agency. Cl has investigative jurisdiction, as 
well as case dispositions, for CII involving active or retired members of the U.S. 

Army and DOD civilians working overseas. The FBI has jurisdiction for DOD 

civilians employed within the Continental United States (CONUS). 

NOTE: The SSBI will NOT be changed to a CII if the information reflects adversely 

on subject's suitability; that is, integrity, discretion, morals, or character. 

Cl Walk-In Interview . A walk-in is an individual who seeks out Cl Agents to 
volunteer information which is believed to be of intelligence value. When an 
individual reports activity that falls within the scope of a CII to an intelligence 
unit or other military organization, this information is immediately reported to 
sub-control offices who have authority to initiate a CII. The CII would be 
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conducted by the appropriate investigative agency having jurisdiction over the 
individual being investigated. DIS could be requested to conduct all or part of 
the military components of the investigation. 

Reports From Other Intelligence and Security Agencies. 

Leads Obtained Directly From Sources Used in Special Operations. 

CII's are generally incident investigations concerning acts or activities which are 
committed by, or involving known or unknown persons or groups. 

Initiation of a CII. 

CII on individuals under the jurisdiction of the Army will be initiated only by: 

* US Army Intelligence and Security Command (INSCOM) ACCO. 

* Sub-control offices overseas. 

* Direction of higher authority. 

CONUS Investigations . Within CONUS, major commands, agencies, and activities will 
forward requests for initiation of CII to INSCOM. When a Cl, which was not 
requested by a major command (MACOM), agency, or activity, is initiated by one of 
the services, the appropriate command will be notified through intelligence 
channels. During the course of a CII, the control officer will keep the MACOM 
informed of the progress of the case. 

NOTE: The Delimitations Agreement of 1949 emphasizes that each military service 

will be responsible for its own internal security. CII on individuals under the 
jurisdiction of the U.S. Army will be initiated only by U.S. Army agencies. 

Overseas Investigations . In overseas areas, the responsibility for investigation 
of the agreed categories rests with the military service that is in supreme command 
of the area. This procedure is subject to coordination with the Central 
Intelligence Agency (CIA) and agreements with other DOD intelligence components and 
host government agencies, IAW AR 381-20. Normally, the Army will be the supreme 
authority in an area of operations or postwar zone of occupation and will have the 
investigative responsibility of espionage, sabotage, and subversion committed by 
any individual in the area. The one exception is personnel under the jurisdiction 
of other military services in the area. This exception is based upon the 
assumption that the Cl agencies of the Navy and Air Force are operational in the 
area and will be able to take care of their own personnel. If they are not, by 
prior agreement with such services, the Army will become responsible for and 
conduct all such investigations. 

"What is derogatory information?" 

Para 1-304.3, AR 380-67, defines derogatory information as: 
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"Information that constitutes a possible basis for taking an adverse or 
unfavorable personnel security action." 

a. Adverse loyalty information (see para 2-200 a-f, 2-200k and Appendix E, 
para 3, AR 380-67). 

b. Adverse suitability information (see para 2-200g-j and 2-200 1-q, Appendix 
E, para, 1, 2, 4, 5, and 6, AR 380-67) . 

c. Appendix I, AR 380-67 discusses the adjudication policy. It provides 
"Disqualifying Factors" - some types of serious conduct that can justify a 
determination to deny or revoke and individuals eligibility for access to 
classified information. 

If the individual is a member of the U.S. Army, action may be taken to suspend 
favorable personnel action concerning him until the investigation is completed. 

This action will be initiated under the provisions of: 

Paragraph 6, AR 600-31, Suspension of Favorable Personnel Actions for 
Military Personnel in National Security Cases and Other Investigative 
Procedures. 

Chapter 4, AR 604-10, Military Personnel Security Program. 

Under the individual flagging action, many personnel actions will be suspended: 
promotions; appointment, enlistment, reappointment or reenlistment; discharge or 
normal release from active duty; entry on active duty; awards, decorations, or 
commendations; retirement; security access; attendance at service education or 
training programs; requests for excess leave; and reassignment, except when cogent 
reasons exist and then only within the command. 

Significant derogatory information: 

SUB-CONTROL OFFICES (SCO). Within DA, the DCSINT has staff responsibility for all C 
I investigative activities. DCSINT formulates policy for the conduct, management, 
direction, and control of Cl operations. 

Administration and control of Cl investigations - special operations, and 
counterespionage project are exercised by INSCOM, through ACCO. The ACCO exercises 
overall control and coordination of MI Army CII, and ultimate case control. Within 
a geographic area or region, INSCOM maintains control of Cl, investigative 
activities through the SCO established in theater support brigades. 

CII are initiated only by the responsible SCO. The following SCOs are responsible 
for all Army CII investigations and operations within their geographic areas: 

* Deputy Chief of Staff for Intelligence (DCSINT), US Army Europe (USAREUR), 
for the Commander-in-Chief USAREUR area of responsibility (G2, USAREUR). 
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* 501st Military Intelligence (MI) Brigade (Bde), for the Commander, Eight 
US Army (EUSA) area of responsibility. 

* S2s for the Commanders, 470th, 500th, and 902nd Military Intelligence 
Brigades. 

* Commander, FCA, USAINSCOM, for all other areas. 

Major commands (MACOM), agencies, and activities within CONUS will forward requests 
for initiation of CII to the appropriate SCO. 

When a CII, which was not requested by another MACOM, agency, or activity is 
initiated by a SCO, the appropriate command is notified through intelligence 
channels. 

During a CII, the SCO will keep the major commander informed concerning the 
progress of the case. 

CENTRAL PERSONNEL SECURITY CLEARANCE FACILITY (CCF). 

Jurisdiction . The Secretary of the Army delegated the authority to grant, deny, or 
revoke security clearances for access to classified defense information to the 
Commander, U.S. Army CCF, under the provisions of DA General Order Number 14, dated 
27 July 1977. 

The DCSINT, DA, delegated the authority to grant, deny, or revoke access to 
Sensitive Compartmented Information (SCI) to the Commander, U.S. Army CCF, under 
CCF, in DAMI-DOS letter, dated 3 October 1977. 

This authority applies to the following DA personnel: 

1. US Army, DA and contractor personnel affiliated with the Department of 
Defense and the Army. 

2. Persons employed, hired on an individual basis, or serving on an advisory 
or consulting basis for whom Army personnel security clearances are required, 
whether or not such persons are paid from appropriate or nonappropriated funds. 

3. Employees of the Army National Guard, Army-Air Force Exchange Service 
(AAFES), American Red Cross, United Service Organization (USO) who are required 
to have Army personnel security clearance. 

4. Reserve Components and National Guard personnel not on active duty. 

5. Members of the Reserve Officers Corps. 

The above includes U.S. citizens who are native born, naturalized, derivative birth 
and derivative naturalization. 

Responsibilities . The commander, CCF, is the only person designated to deny, 
revoke, or restore access when suspended by the local commander. CCF monitors the 
progress of all 
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actions taken concerning the revocation of security clearances and stores all 
reports relating to the security clearances of personnel under its jurisdiction. 

Whenever derogatory information is developed or becomes available to any DOD 
element, it shall be referred to the commander or security offices at the 
organization to which the individual is assigned for duty. The commander or 
security officer shall review the information in terms of its security significance 
and completeness. If further information is needed to confirm or disprove, 
additional investigation should be requested. 

When the Commander learns of derogatory information on a member of his/her command 
that falls into the scope of para 2-200, AR 380-67, the commander will immediately 
forward DA Form 5248-R to Commander CCF. DA Form 5288 will be submitted in a 
timely manner and will indicate detail information and actions being taken by the 
commander or appropriate authority (i.e., conducting an inquiry or investigation). 
Follow-up will be submitted at 90 day intervals if the commander has not taken 
final action. At the conclusion of the command action, a final report will be 
forwarded to CCF that must contain results of any local inquiry, investigations, or 
board actions and recommendations of the command concerning restoration or 
revocation of the individuals security clearance. Commanders will not delay any 
personnel actions while waiting final action by CCF. Actions should proceed with 
CCF being informed by DA Form 5248-R. 

* If a personnel file does not indicate the existence of a security 
clearance, commanders must still report information that falls into the 
scope of para 2-200, AR 380-67, since the person may require a security 
clearance at a later date. Only a final report is required. 

* Suspend individual's access on an "informal" basis while gathering 
information to determine a formal suspension is warranted and forward all 
derogatory information to CCF on DA Form 5248-R with the commander's 
recommendation. If the commander does not suspend access, CCF will review 
available information and may advise the commander to suspend. 

* If the commander decides on formal suspension of access, DA Form 873 will 
be removed from individuals personnel file and attached to DA 5248-R and 
reported to CCF. Once this is done, the commander may not restore access 
until a final determination is made by Commander, CCF. 

When CCF receives derogatory information and denial or revocation of a security 
clearance and or access to SCI is deemed appropriate, CCF will: 

* Forward a Letter of Intent (LOI) through the command security manager to 
the individual. The LOI will outline the derogatory information and 
explain the proposed actions. The LOI will offer the individual the 
chance to reply in writing the chance to explain, refute or mitigate the 
incidents. 

* The LOI will direct suspension of access to classified material. If the 
LOI addresses SCI access, only, collateral access may continue. 
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The individual will acknowledge receipt of the LOI by signing and dating the 
enclosed form letter. The person will indicate his/her intention of submission of 
a rebuttal. The form letter will be submitted to CCF immediately. 

The commander will ensure that the person is counseled as to the seriousness of 
CCF's contemplated actions and will offer advice and assistance in forming a reply. 
The individuals response must address each issue raised in CCF LOI. Any written 
documentation may be forwarded as well as letters of recommendations from 
supervisors. The response will be forwarded to CCF through the representative who 
provided the LOI. 

All replies to Letters of Intent will be endorsed by at least one commander. 
Endorsements should include commander's recommendation(s) to deny, revoke or 
restore the individual's security clearance. The commander should provide a 
rationale addressing the issues outlined in the LOT. Responses without commander's 
recommendation will returned for comment. 

When the Commander, CCF, receives the response to the LOI, a final determination is 
made. The final determination is furnished through the security officer to the 
individual. IAW AR 600-7-, CCF provides unfavorable information to the DA 
Suitability Evaluation Board (DASEB), USAR Personnel Center, or National Guard 
Personnel Centers on all E6 and above, commissioned and warrant officers. A copy 
of the LOI, individual rebuttal and CCF final letter will be provided. DASEB will 
determine which information will remain in the military personnel file. 

When an individual is incarcerated by military or civil authorities on a conviction 

of a criminal offense, or when a person is dropped from the rolls as a deserter, 

his commander will take the following actions immediately. 

* Withdraw the DA Form 873 from the individual's Military Personnel Records 

Jacket (MPRJ) GR GPF and stamp or print across the face, "Revoked by 

authority of Commander, CCF, Deserted-(Date)," or "Revoked by authority of 
Commander, CCF, incarcerated as a result of civil conviction or court 
martial (date)." 

* Forward the DA Form 873 - and DA Form 5248-R explaining the circumstances 
to the Commander, CCF, (PCCF-M), Fort George G. Meade, MD 20755-5250. 

* If no DA 873 is in the MPRJ or OPF, DA 5248 explaining the circumstances 
will be forwarded to Commander, CCF (PCCF-M). 

* If the person has transferred, endorse the LOI, to the gaining command and 
forward an info copy to CCF (PCCF-M). If released from active duty, with 
a Reserve Obligation forward the LOI to the U.S. Army Reserve Personnel 
Center, ATTN: DARP-SPI, St. Louis, MO 63121-5200. Forward a copy to CCF 
(PCCF-M). 

* If released from active duty without a reserve obligation, endorse the LOI 
to CCF (PCCF-M) with copy of discharge orders. 

CONDUCT OF A CII . Cl Agents conducting CII investigations must have a thorough 
understanding of the objectives and operations of foreign espionage, sabotage, and 
subversive organizations: Cl investigative training; and training and/or experience 
in counterespionage 
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operations. This is necessary because it is critically important during the 
conduct of a CII that all information is fully developed and properly presented, 
regardless of whether or not the information is favorable to the subject. Also, 
all data obtained must be factually presented to eliminate any need for presumptive 
evaluation during the adjudication of the case. 

The most important fundamental that should be remembered concerning the conduct of a 
personal subject CII is that the Cl Agent must attempt to prove or disprove the 
allegation against the subject. 

The Cl Agent must remember to use caution during the investigation, especially when 
interviewing the immediate supervisor of a subject, so as not to compromise the 
investigation or cast a stigma on the subject. 

When interviewing a source, the Cl Agent will attempt to obtain a sworn statement 
in the sources own handwriting, if derogatory information reflecting on the 
subject's loyalty arises, or if information is obtained which refutes previously 
obtained information concerning the subject's loyalty. If illegible, prepare a 
typewritten sworn statement for the source to review and sign. Include the 
original handwritten statement as an attachment to the IMFR. Never destroy the 
original statement. 

For Record . When conducting a CII, the Cl Agent's objective of the investigation 
is to determine the nature and extent of damage to national security. The intent 
is to develop information sufficient enough to permit its use in a civil or 
military court or to initiate Counterespionage (CE) procedures. However, the 
investigation should not be limited to collecting only evidence which is admissible 
in court. The investigation reports should include all relevant and material 
information. The Cl Agent must remember that hearsay and opinions expressed by 
sources during an interview may serve a further use as leads in continuing the 
investigation. The Cl Agent must also remember to limit his investigation to the 
allegation. 

Often during the course of an investigation, information relevant to other areas of 
possible Cl interest develop. This information will generally concern the 
suitability of the individual as regards his morals, character, and integrity. 

This information will be reported by the Cl Agent but not pursued unless 
specifically tasked. 

In accordance with the provisions of AR 381-20, it is the policy of the DA to 
afford the subject of a CII every reasonable opportunity to explain, refute, or 
mitigate any adverse information directly involving him. This is accomplished 
through a subject interview. A subject interview is advantageous to both the 
subject, by affording him the opportunity to tell his side of the story, and to the 
government. A Cl Agent must get permission from his control officer prior to 
interviewing a subject of a CII. 
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LESSON 1 


PRACTICE EXERCISE 

The following items will test your grasp of the material covered in this lesson. 
There is only one correct answer for each item. When you have completed the 
exercise, check your answers with the answer key that follows. If you answer any 
item incorrectly, study again that part of the lesson which contains the portion 
involved. 

1. There are four signers of the Delimitations Agreement. They are the DCSINT, 
DA; the Office of Naval Criminal Investigative Service (NCIS), US Navy; the 
Office of Special Investigations (OSI), Inspector General, US Air Force; and 
which of the following? 


A. 

Central 

Intelligence Agency. 

B. 

Defense 

Intelligence Agency. 

C. 

Defense 

Investigative Service. 

D. 

Federal 

Bureau of Investigation 


2. The authority to grant, deny, or revoke personnel security clearances to 
classified defense information has been delegated to the Commander, CCF, by 
which of the following? 

A. Secretary of the Army. 

B. Commander, USAINSCOM. 

C. Commander, DIS. 

D. DCSINT, DA. 

3. Adverse information in which of the following areas would be justification 

for changing a SSBI to a CII? 


A. Morale. 

B. Loyalty. 

C. Integrity. 

D. Discretion. 
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4. Special Agents conducting a CII will limit the investigation strictly to the 
production of evidence which is admissible in court. 

A. True. 

B. False. 


5. From whom is prior approval requested from concerning the use of covert 
investigative techniques if legal doubt exists? 

A. Commander, USAINSCOM. 

B. FBI. 

C. Secretary of the Army. 

D. DCSINT, DA. 
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LESSON 1 


PRACTICE EXERCISE 
Answer Key and Feedback 
Item Correct Answer and Feedback 


1. 

D. 

Federal 

Bureau of Investigation. (page 

2. 

A. 

Secretary of the Army. (page 1-6). 

3 . 

B. 

Loyalty. 

(page 1-4). 

4 . 

B. 

False. 

(page 1-10) . 

5. 

D. 

DCSINT, 

DA. (page 1-2). 
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LESSON 2 


CONDUCT Cl INVESTIGATIONS OF SABOTAGE, ESPIONAGE, TREASON, 

SEDITION, AND SUBVERSION 

CRITICAL TASKS: 301-340-1001 
301-340-2009 

OVERVIEW 

LESSON DESCRIPTION: 

In this lesson, you will learn how to plan, prepare for, and conduct sedition, 

subversion, sabotage, espionage, and treason investigations; the legal constraints 

involved with this type of Cl investigation; and how to properly record results of 

the investigations. 

TERMINAL LEARNING OBJECTIVE: 

ACTIONS: Plan, prepare for, conduct, and record the results of sedition, 

subversion, sabotage, espionage, and treason investigations. 

CONDITIONS: You will be given narrative information and illustrations from FM 

34-60 and FM 34-60A. 

STANDARDS: You will plan, prepare for, conduct, and prepare properly formatted 

reports for the conduct of designated Cl investigations IAW the 
provisions of STP 34-97B4-SM-TG. 

REFERENCES: The material contained in this lesson was derived from the following 

publications: 

AR 380-5 
AR 381-10 
AR 381-12 
AR 381-20 
FM 34-60 
FM 34-60A 
STP34-97B4-SM-TG 
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This lesson has five parts: 


Part 

A: 

Sabotage. 

Part 

B: 

Espionage. 

Part 

C: 

Treason. 

Part 

D: 

Sedition. 

Part 

E : 

Subversion 


PART A: SABOTAGE 

ELEMENTS OF SABOTAGE . The elements of sabotage are set forth in title 18, US Code, 
Sections 2151-2156. It is summarized in FM 34-60 as 

"An act of which is to damage the national defense structure; 

Sabotage is also a form of "subversive warfare" which can be used to impair the 
will of the populace to resist. Sabotage is an effective weapon designed to damage 
or destroy a nation's capacity to defend itself. It is indispensable to warfare, 
and used by all nations. It is not a recent innovation of modern warfare. During 
Biblical times, armies destroyed the enemy's fields, crops, cities, and towns. 

At the turn of the 18th century in France, peasants were angered by the fact that 
machines were replacing workers. A French workman angrily threw a shoe into the 
machinery when he was working. Consequently, the term "sabotage" is accredited to 
the French word "sabot", a wooden shoe. Regardless of the origin of the word, the 
fact exists that sabotage has been used in one form or another through the 
centuries. It was used extensively and effectively during the last two World Wars 
and in other outbreaks of hostilities and armed conflict. 

We expect acts of sabotage, both in overseas area of operations(AO)/and in CONUS, to 
increase significantly in wartime. Sabotage is an effective weapon of guerrilla 
and partisan groups operating against logistical and communication installations in 
occupied hostile areas, and during insurgencies. 

Sabotage may be conducted by trained saboteurs sponsored by hostile guerrilla, 
insurgent, or intelligence organizations or by individuals operating independently 
who are motivated by revenge, hate, spite, or greed. In internal defense or 
limited war situation where guerrilla forces are active, we must be careful to 
distinguish between acts involving clandestine enemy agents and armed enemy units 
or dissatisfied friendly personnel. The threat posed to DOD by this hidden army of 
potential saboteurs is a challenge to Cl personnel. Ferreting out individuals in 
the Army establishment who are members of this hidden force is a continuous, direct 
effort of Cl. For that reason, the Cl investigator must be acquainted with the 
saboteur's potential targets; methods; and capabilities. Equipped with this 
knowledge, he is better prepared to detect, prevent, and neutralize sabotage 
conducted against or within the Army establishment. 
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Sabotage or suspected sabotage are normally categorized by the means employed. The 
traditional types of sabotage are incendiary, explosive and mechanical. Decline of 
communism, sabotage can take on a new form with nuclear, biological chemical, 
magnetic or electromagnetic means. With the rise and dependency of computers 
sabotage can take on a new means. 

Types of Saboteurs . Saboteurs are classified into two main categories: independent 
saboteurs and enemy agents. Both are dangerous because their actions can have a 
serious effect upon wars or the national defense. 

* Independent Saboteurs. While not in the employ of any foreign power, but 
for reasons of their own, they commit acts of sabotage that aid the enemy. 
An example would be the individual who sets fire to an installation or 
activity as an act of defiance against an unwanted reassignment. As 
stated earlier, this type is normally motivated by revenge, hate, spite, 
or greed. Actions committed by the independent saboteur would probably 
not be considered sabotage in the Cl sense; however, each case must be 
considered on its own merits. 

* Enemy Agents. More dangerous, the enemy agent is recruited, trained, and 
directed from a sabotage organization which is expert in covert 
operations. The agents are carefully selected and trained to perform all 
types of missions. The sabotage effort can be a constant threat to the 
security of the target nation when coordinated with other weapons and 
measures used by the enemy. 

Sabotage Targets . Sabotage targets are virtually limitless. Many likely sabotage 
targets are readily accessible to the average citizen during the course of his 
daily activities. However, Cl investigative responsibility is limited to 
countersabotage measures within the Army establishment and areas over which it has 
j urisdiction. 

Types of Targets . Sabotage targets will be at any echelon. 

Example targets are those that must be reduced for tactical reasons, or could make 
the continuances of war difficult if not impossible. 

* Bridges. 

* Tunnels. 

* Supply storage areas. 

* Railway systems. 

* Communication facilities. 

* National level economics, political, geographical, and military resources. 

* Industries. 
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Target Analysis . The factors considered by the saboteur in his target analysis are 


* Criticality: Items needed for national defense. 

* Vulnerability: The degree of susceptibility of a target to damage. 

* Accessibility: The degree of ease or difficulty in infiltrating the 

target area. 

* Recuperability: Restoration of a target to a point where the original 
purpose is served. 

The last factor, recuperability, is most important to the saboteur. The target 
must be reduced to a state of incapability for a reasonable period of time to be 
worth the risks involved. 


SABOTAGE METHODS . There are many different methods to commit sabotage, some of 
which are neither physical nor violent. Passive Sabotage is a nonviolent means or 
indirect action directed at morale. It involves passive resistance on the part of 
the populace. It is not organized to the extent that individuals or groups are 
given specific tasks. 


Active Sabotage is the method of sabotage of primary interest to the Cl 
investigator. It has the physical forms of sabotage as expressed in Title 18, US 
Code. They are classified as: 

* Incendiary. 

* Explosive. 

* Mechanical. 


The saboteur decides which form he will use based on type of target; vulnerability; 
security; desired effects; time element; and availability of sabotage materials. 


The question of which form is more effective against specific types of targets is 
relatively easy to decide. However, the ability to properly use the various 
methods depends upon the training of the saboteur. 


Incendiary Sabotage . Is the use of a combustible material to maliciously start a 
fire to destroy property. Normally, this constitutes arson. (Arson becomes an act 
of sabotage when there Is an Intent to hinder defense efforts and reason to believe 
the act may hinder the war effort.) 

Explosive Sabotage . Violently destructive and, when properly used, can neutralize 
or destroy targets which are resistant to fire. The saboteur will use explosives 
on selected targets when speed of destruction is desired, or when he wants to 
instill fear among the populace or employees of an installation. 

Mechanical Sabotage . The easiest to perpetrate and is usually directed against 
industries, railroads, and ships. No special tools are required; the main 
requirement is the saboteur must have access. The five basic classifications of 
mechanical sabotage are-- 
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* Breakage. 

* Use of abrasives. 

* Acts of omission. 

* Substantiation. 

* Contamination. 

These acts cover a wide field and may be committed by the saboteur either singly or 
in combination. 

SABOTAGE BY NUCLEAR. BIOLOGICAL. AND CHEMICAL (NBC) MEANS . We are aware of the 
immense destruction capability of nuclear weapons and also of the fact that the 
U.S. has no monopoly over the manufacture of these weapons. With respect to 
biological and chemical agents, we know other nations have exhibited an interest in 
these areas. The former Soviet Union has experimented with and standardized some 
of these agents. Suffice to say, small nuclear weapons and controlled biological 
and chemical agents have definite sabotage potential. 

Biological Agents . Biological warfare (BW) is the military use of living organisms 
or their toxic products to cause death, liability, or damage to man, domestic 
animals, or crops. BW has never been used on a large scale with modem weapons. 
However, throughout history there are documented cases wherein diseases were used 
in attempts to reduce an enemy's ability to fight. 

Chemical Agents . Chemical warfare (CW) agents can produce effects ranging from 
highly lethal to mildly incapacitating. There are many chemical compounds, 
producing various effects, available to the saboteur. Such compounds could include: 

* Agents which produce a deep sleep for several hours. 

* Lethal poisons which enter the body through a small break in the skin. 

* Chemicals to contaminate drinking water. 

Whatever chemical or agents the saboteur uses, all can be disseminated by means of 
aerosols, capsules, vials, special dispersal containers, or spread in areas to be 
carried by wind and dust. 

Nuclear Devices . An important factor when discussing the potential use of nuclear 
devices for sabotage is the destructive capability of an atomic explosion. Some 
atomic demolition devices destroy indiscriminately. Others, like biological and 
chemical warfare agents, destroy only personnel. Buildings, machinery, and 
equipment all remain unharmed. We must not rule out the possibility that, should 
the enemy launch a major attack against the U.S., all three sabotage means-nuclear, 
biological, and chemical-will be used to the fullest extent. 

ARSON . Arson is one of the saboteur's most effective weapons. He may apply flames 
directly to combustible material or he may employ mechanical timing devices for 
delayed ignition. For 
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any case in which sabotage is a possibility, the following are accomplished by MP 
and/or criminal investigators: 

* Protect the scene from mutilation by removing all unauthorized people from 
the area, roping off the area if necessary, and posting guards to deny 
entrance and prevent removal of any items. 

* Locate witnesses, record their names and addresses, and, if feasible, hold 
them for questioning. Witnesses held should be segregated. Notify MI. 

Burning Factors . Combustion or burning is the rapid oxidation of substances 
accompanied by generation of heat and light. Burning occurs only when three 
essential ingredients are present-fuel, oxygen, and a temperature sufficiently high 
to maintain the process of combustion. Withdrawal of the fuel, elimination of 
oxygen, or lowering of the temperature will extinguish the burning. 

Although fuels may be gaseous, liquid, or solid, combustion usually occurs when 
they are in a finely divided vaporous state. With many materials, oxidation takes 
place slowly at room temperature. However, for oxidation to reach the point of 
combustion, the materials must be heated. When heated, an oxidizing agent gives 
off oxygen, which in turn has an intense attraction for any fuel. If the ignition 
temperature is reached, a violent reaction occurs. 

Most ordinary combustibles are compounds of carbon and hydrogen with the frequent 
addition of mineral matter and oxygen. When they burn completely and freely in 
air, the carbon reacts with the oxygen to form carbon dioxide, the hydrogen 
combines with the oxygen to form water vapor, and the mineral matter remains behind 
as ash. 

Several factors contribute to the spreading of a fire. Drafts and air supply 
directly affect behavior of fire. A fire started in a completely closed space will 
soon become extinguished due to use of the available oxygen and generation of 
noncombustible gases which smother the fire. 

Conversely, the combustion rate is greatly increased if the slightest chimney 
action exists where the hot gases and flame from the fire contact combustible 
material. Disastrous fires have resulted in large buildings where the elevator 
shafts or stairways served as a chimney to direct the uprushing flames and gases. 

Other factors that may influence the spread of fire include: 

* Dryness of surrounding vegetation or the structure itself. 

* Presence of rain or amount of humidity. 

* Temperature of the surrounding air. 

* Building construction, to include wooden partitions, unprotected doors and 
window, elevator shafts and stairways, overhanging eaves, and wooden 
shingles. 
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EXPLOSIONS . An explosion is the rapid and violent combustion of a material (solid, 
liquid, or gas) with resultant pressure and heat. Explosions are generally 
classified as low- or high-order, according to the speed in feet per second of the 
expansion caused by the combustion. 

Low-order explosions (diffused) . An explosion in this category is characterized by 
a slow expansion over a relatively wide area into a combustion known as 
deflagration. Most explosives causing this type of explosion have a pushing rather 
than a shattering effect which results in a twisting and tearing type of 
deformation. 

In a building, walls are forced outward, causing the roof to fall into the 
interior. Objects are scattered in erratic directions with no semblance of 
pattern. Other normal characteristics are absence of local shattering, craters, 
and a clearly marked area of special damage or discoloration. Such explosions 
result from gas, liquid fuel, solvents, dust, and chemicals. 

High-order explosions (concentrated) . An explosion in this category is 
characterized by an extremely rapid combustion, known as detonation reaction, 
occurring through the action of explosives such as dynamite, TNT, nitroglycerine, 
penta erythritol tetra nitrate (PETN), and various "plastic" explosives. 

No atmospheric oxygen is required since the explosive carries its own oxygen supply 
in the form of compounds of high oxygen content. An explosion of this nature 
produces a large volume of gas, heated and expanded by the heat of the reaction. 

Its origin can be considered a point where the forces produced radiate equally in 
all directions. Near the center, there will usually be shattering or fragmenting 
of material with evidence of small, high- velocity fragments. Movable objects and 
debris will be blown out in a radiating pattern from the center of the explosion. 
Suction effect or deflection of forces by objects may after this pattern, but 
identification of the pattern should still be possible. 

X-ray films of cadavers, burned by the explosion, may reveal foreign objects which 
are helpful in the identification of the explosive device used. 

The difference between the two types of explosions is significant to the 
investigator because the first type is ordinarily accidental while the second is 
more likely to be deliberate or planned. 

Explosive Accessories . Safety fuse. Usually consists of a train of black powder 
in waterproof casing. The fuse is the medium for carrying a flame to the explosive 
charge. 

Detonating cord. An example would be PETN explosives which are wrapped in a 
protective casing that makes them insensitive to shock. Detonating cord and fuses 
are used to detonate main charge explosives. 

Blasting caps and detonators. Are copper or aluminum cases filled with an 
initiating and a detonating charge. They may be nonelectric or electric. Blasting 
caps and detonators are ignited in one of two ways: 
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* Ignition by safety fuse. Crimpers must be used to clamp the detonator to 
the fuse. Tool marks left by the crimpers on detonator case fragments 
found at the scene of the explosion may aid in making positive 
identification of suspect tools. 

* Electrical ignition. Detonators are wired to an electrical source. 

Closing the circuit will result in instantaneous or timed (interval) 
explosions. Connecting wires usually remain intact after explosion which 
may provide valuable trace evidence. 

Boosters. An explosive charge is sometimes used to amplify or boost the shock 
provided by detonators or blasting caps in order to detonate main charge explosives. 

Timing devices. Electrical, mechanical, or chemical devices may be used to trigger 
an explosive charge at a predetermined time. 

Handling Explosives . Ordnance detachments (explosive disposal) are strategically 
located through out CONUS and overseas commands. Members of these detachments are 
qualified explosive disposal technicians. 

In cases where the use of explosives is suspected, the explosive ordnance disposal 
(EOD) control detachment nearest the scene should be notified immediately for 
support. 

The EOD technicians can provide invaluable assistance not only in disarming 
explosive devices, but also in the identification of residue of devices that have 
exploded. These remnants may give excellent clues concerning the type of explosive 
used, how it was detonated, and how and where it was manufactured (commercially or 
homemade), and the approximate amount of explosive used. 

Undetonated explosive residues (in the area, in safelocks, keyholes, and so on), 
spilled explosives, and explosive charges left behind by the perpetrator must not 
be touched. Even a small amount of explosive residue can be detonated and cause a 
serious explosion. 

The explosives technician provided by the EOD detachment will decide whether the 
bomb will be disarmed or destroyed. If the expert decides to destroy the device, 
the investigator may be able, beforehand, to photograph its outer surfaces, or, if 
it is packaged, photograph the writing or postage data on the wrappings. If the 
device is destroyed, the investigator should carefully collect all remaining 
evidence. 

Do not photograph bombs or explosive charges with a flashbulb since the heat may 
cause detonation. 

The search for remaining explosives at the scene must be supervised by an EOD 
technician. In case of suspected sabotage, local MI personnel are notified. If 
the incident takes place within CONUS, the FBI must be contacted. 

CONDUCT OF SABOTAGE INVESTIGATIONS . U.S. Army Criminal Investigation Division 
Command (CIDC) will assume investigative lead for actual or suspected sabotage. Cl 
elements will monitor the CIDC investigation and attempt to ascertain the existence 
of hostile, enemy, or foreign Government involvement or intent of the sabotage. Cl 
elements will not conduct their 
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own investigation until foreign Government involvement or intent of the sabotage. 

Cl elements will not conduct their own investigation until foreign Government 
involvement is evident or suspected. If foreign Government involvement is 
determined, then a Joint (CI/CIDC) investigation may be conducted, with CIDC 
normally retaining investigation lead. 

As a Cl Agent, you are not expected to be a technical expert in the chemistry of 
fires and explosives or to be fully knowledgeable of machinery and complicated 
equipment. You are, however, encouraged to obtain the assistance of technical 
experts during the planning stage of a sabotage investigation. 

Fundamental Investigative Rules . Three fundamental investigative rules should be 
foremost for the Cl Agent investigating a sabotage incident. They are as follows: 

* Sabotage investigations require immediate action. 

* The saboteur may still be near the scene, so other military targets may 
require immediate additional security protection to preclude or limit 
further damage. 

* The incident scene must be preserved and analyzed before evidence is 
altered or destroyed. 

General Investigative Guidelines. When conducting investigations of sabotage, the 
Cl Agent must proceed with objective, and logical thoroughness. The standard 
investigative interrogatives apply: 

WHO: Determine a list of probable suspects and establish a list of persons 

who witnessed or know about the act. 

WHAT: Determine what military target sabotaged and the degree of damage, to 

the target (momentary and operational). 

WHEN: Establish the exact time when the act of sabotage was initiated and 

when it was discovered; from as many sources as possible. 

WHERE: Determine the precise location of the target and its relation to 
surrounding activities. 

WHY: Establish all possible reasons for the sabotage act through the 

investigation of suspects determined to have had a motive, ability, and 
opportunity to accomplish the sabotage act. 

HOW: Establish the type of sabotage (such as, incendiary, explosive, 

mechanical, chemical) and determine the procedures and materials 
employed through investigation, technical examination, and analysis. 

Special Investigative Actions . The following outline of possible investigative 
actions may be used as a guide for investigating most incidents in which sabotage 
is suspected: 
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Obtain information and analyze the details surrounding the initial reporting of the 
incident to the CIDC unit. Establish the identity of the person reporting the 
incident and his reason for doing so. Determine the facts connected with the 
reported discovery of the sabotage and examine them for possible discrepancies. 

Examine the incident scene as quickly as possible. The Cl Agent will attempt to 
reach the scene before possible sources have dispersed and evidence has been 
disturbed. 

* Assist the MP protect the scene from disruption. The MP will remove all 
unauthorized personnel from the area, roping off the area if necessary, 
and post guards to deny entrance and prevent anything from being removed. 

* Cl Agents should help MP investigators at the crime scene; they should not 
interfere with the crime scene investigation. 

* Cl Agents may help CIDC personnel process the crime scene, to include 
locating all possible sources for questioning. Cl keep sources separate 
only in the sense that they are identified to MP or CIDC. Cl Agents 
should not physically separate sources. 

* Preserve the incident scene by taking notes, making detailed sketches, and 
taking pictures. See appendix A for a more detailed explanation of crime 
scene processing. 

* Arrange for technical experts to search the scene of the sabotage act; 
collect and preserve physical evidence; and obtain all possible clues. 
Arson specialists, explosives experts or other types of technicians may be 
required. 

* Take steps necessary to prevent further damage to the target and safeguard 
classified information or material. 

* Interview sources and obtain sworn statements as soon as possible to 
reduce the possibility of forgetting details or comparing stories. 

* Determine the necessary files to be checked. These will be based on 
examination of the incident scene and by source interviews. Cl conducts 
such action only in coordination with CIDC. CIDC has the crime scene 
expertise and responsibility; Cl has the modus operandi (MO) expertise to 
identify to CIDC. Source file of particular importance may include: 

1. Friendly unit MO file. 

2. Partisan, guerilla, or insurgent activity file. 

3. Local police files on arsonist. 

4. Local police MO files. 
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5. Foreign intelligence agency MO files. 

6. Terrorist MO files. 

7. Provost Marshal files. 

File checks should include background information on sources and the 
person who discovered and reported the act of sabotage. 

Interrogate suspects. Study all available information such as evidence, 
technical and laboratory reports, statements of sources, and information 
from informants in preparation for interrogation of suspects. 

PART B: ESPIONAGE 

ELEMENTS OF ESPIONAGE . Unlike sabotage cases, most espionage investigations will be 
personal subject rather than incident-type cases; that is, they will originate 
with allegations regarding the activities of known individuals. There are 
instances, however, when Cl personnel will be directed to conduct investigations of 
incidents in which espionage is suspected, but the identity of suspect (s) has not 
been established. 

Leads in espionage investigations may originate from a wide variety of sources, 
prominent among which are the following: 

* Reports from sensitive sources. 

* Reports from other intelligence, security, and law enforcement agencies. 

* Evidence of espionage discovered during inspection and surveys, of 
classified document handling and storage procedure. 

* Reports submitted by military and civilian personnel IAW AR 381-12. 

* Evidence of espionage discussed during screening of refugees, line 
crossers, displaced persons, civilian interns, enemy prisoners of war 
(EPW), detectors, and similar groups in areas of armed conflict 

* Information developed during the course of routine PSI . 

There are five elements of espionage: 

* Contact or communications. 

* Collection. 

* Tradecraft. 

* Reward or Motive. 
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* 


Travel. 


All of these elements are identifiable during the course of a counter espionage 
(CE) investigation. Examples of the elements of espionage are that: 

(1) The accused communicated, delivered, or transmitted any document, writing, 
code book, signal book, sketch, photographic negative, blueprint, plan, map, model, 
note instrument, appliance, or information relating to national defense. 

(2) This matter was communicated, delivered, or transmitted to any foreign 
Government, or to any portion or party or military or Naval Force within a foreign 
country, whether recognized or unrecognized by the US, or to any representative, 
officer, agent, employee, subject, or citizen thereof, either directly or 
indirectly. 

(3) The accused did so with the intent or reason to believe that such matter 
would be used to the injury of the US or to the advantage of a foreign nation. 

Federal Espionage Statutes . The espionage statutes encompass many kinds of 

activities. They have as their ultimate goal to prevent defense information 

from falling into the hands of a foreign nation. The outstanding aspects of 

the Title 18, US Code, Sections 793-796, are summarized in FM 34-60 as follows: 

"The Act, either directly or indirectly, of obtaining, delivering, 
transmitting, communicating, or receiving information in respect to 
national defense with the intent or reason to believe that the 
information may be used to the injury of the U.S. or to the advantage 
of any foreign nation. The offense of espionage applies in time of 
peace or war." 

Investigative Guidelines in Espionage Cases . Analysis of the statute and pertinent 
court decisions permit the following conclusions to be drawn about proof of 
espionage: 

* "National defense information: is information of military significance 
which has not been published for public consumption; that is, not 
distributed in public channels. It need not be classified defense 
information as defined in AR 380-5. The critical points are if it relates 
to the national defense and has been restricted to authorized channels. 

* "Any foreign nation" means the nation involved need not be a declared 
enemy. 

* Loss through gross negligence requires no positive act because it is a 
crime of omission. 

* Each facet, "loss through gross negligence" and "failure to promptly 
report," is a separate and distinct crime. 

The espionage investigation must be directed toward the collection of information 
and evidence to show national defense information was involved, and there was an 
intent or reason to believe the US would be injured or a foreign nation would 
benefit. 
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Spying, Article 106, Uniform Code of Military Justice (UCMJ). Spying is strictly 
limited to a wartime military situation. This is governed by international law, 
particularly the provisions of the Geneva Conventions. Although the crime of 
spying as defined in Article 106, UCMJ, differs from espionage, CII based on 
Article 106 are categorized as espionage cases for reporting and statistical 
purposes. There are five elements that must be present to constitute the crime of 
spying: 

* It only occurs during time of war. 

* It is committed in a U.S. military AO. 

* The accused must be caught while seeking information to communicate to the 
enemy. 

* The accused must have the intent of communicating the information to the 
enemy. 

* The accused must have been acting in a clandestine manner. 

Conduct of Espionage Investigations . No single set of investigative procedures Is 
applicable to the conduct of espionage investigations. Espionage is made up of 
many different elements; espionage investigations are not always aimed at the 
arrest and prosecution of the offender. Prosecution of espionage case may be 
deferred to the Department of justice, CONUS or to the host country OCONUS. Cl 
Agents responsible for such an investigation must have a thorough and up-to-date 
knowledge of all espionage and counterespionage methods and procedures as discussed 
in FM 34-5 (S) . 

In any espionage case, use any or all types of investigative techniques and tools 
described in FM 34-60 AND 34-5(S). 

* Determine what specific techniques to use on a case-by-case basis. 

* Get proper authorization to utilize investigative techniques. 

* Conduct the investigation IAW current laws and regulations. 

Records examinations may break the cover story of an espionage suspect. Cl Agents 
may use properly authorized physical or technical surveillance to obtain leads or 
evidence. They may use confidential or sensitive source or undercover operations 
to locate and identify suspects. Investigative photography may provide evidence of 
an attempt to transmit national defense information to a foreign nation. 

The following quotation from testimony in February 1950 by the late J. Edgar 
Hoover, who was then FBI director, explains why arrest and prosecution are not 
always the objectives of espionage investigations: 

"In a criminal case, the identification and arrest of the wrongdoer are 
the ultimate objectives. In an espionage case, the identification of the 
wrongdoer is only the first step. What is more important is to ascertain 
his contacts, his objectives, his 
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sources of information and his methods of communication. Arrest and 
public disclosure are steps to be taken only as matters of last resort. 

It is better to know who these people are and what they are doing, and to 
immobilize their efforts, than it is to expose them publicly and then go 
through the tireless efforts of identifying their successor." 

PART C: TREASON 

ELEMENTS OF TREASON . Treason is the only crime defined in the US Constitution. 
Historically, those in power passionately desired to remain in power. In order to 
do so, any opposition was usually severely punished. Thus, treason (the historical 
name for violent opposition) was regarded by those possessing autocratic power as 
the most heinous crime, punishable with swift, harsh, and extraordinary punishment. 
The laws regarding treason were greatly abused because of their application in 
struggles for retention of power. 

The framers of the American Constitution had every right to be apprehensive about 
the improper application of the concept of treason. The turmoil-ridden history of 
English treason and seditious libel had been carried to the American colonies. 

Prior to the American expression of treason, punishment was not limited to the 
perpetrator of the act of treason. An adverse effect was felt by the close kin and 
heirs of the convicted enemy of the state. Corruption of blood and forfeiture of 
estates, existing or inheritable, were popular forms of secondary punishment and 
state enrichment. Thus, aware of a need to limit the scope of such punishment. 
Article III, Section 3 of the U.S. Constitution was written. An extract is as 
follows: 

"Treason against the United States, shall consist only in levying war 
against them, or in adhering to their enemies, giving them aid and 
comfort. No person shall be convicted of treason unless on the testimony 
of two witnesses to the same overt act, or on confession in open court. 

The Congress shall have power to declare the punishment of treason, but no 
attainder of treason shall work corruption of blood, or forfeiture except 
during the life of the person attainted." 

Investigations in which treason is suspected or alleged are rare. Most cases occur 
during wartime, or upon conclusion of hostilities. 

Allegations of treason may originate with: 

-Liberated Prisoner of Wars 

-Interned US Civilians 

-Examination of Captured Enemy Records 

-Interrogation of Enemy Military and Civilian Personnel 

Federal courts have recognized two distinct types of treason: Levying war and 
aiding and comfort. 

Elements of Treason Under Federal Statute . Interpretation by the federal courts in 
treason 
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cases leads to the following generalities concerning the legal elements of the 
crime of treason under federal statute: 

* The accused must owe allegiance to the U.S. A U.S. citizen owes permanent 
allegiance whether in the U.S. or on foreign soil (unless an effective 
renunciation of citizenship was made). An alien in the U.S. owes 
temporary allegiance to the U.S. because he enjoys the protection of U.S. 
laws. 

* A levy of war must be an actual waging of open hostilities against the 
government with specific intent to cause its overthrow. 

* Adherence to the enemy means, in general, any act committed after a state 
of war exists which indicates a want of loyalty to the U.S. Government, 
and sympathy with its enemies, and which, by fair construction, is 
directly in furtherance of their hostile designs. 

The investigative burden for a treason case consists of proving the following: 

* The individual owed allegiance to the US when the act was committed. 

* During the levy of war, there were open hostilities against the US and 
there was a specific intent to overthrow the US Government. 

* The individual provided tangible or intangible aid to the enemy. 

* Two witnesses to the same overt act must testify or it must be established 
that the accused intends to confess in open court. 

Aiding the Enemy, Article 104, UCMJ . Investigations conducted by Cl personnel to 
prove or disprove charges brought against an individual subject to the UCMJ under 
Article 104, Aiding the Enemy, may in some cases be categorized as treason cases. 
The article provides that "any person who (1) aids, or attempts to aid, the enemy 
with arms, ammunition, supplies, money, or other things or (2) without proper 
authority knowingly harbors or protects or gives intelligence to, or communicates, 
or corresponds with or holds any intercourse with the enemy, either directly or 
indirectly, shall suffer death or such other punishment as court-martial or other 
military commission may direct." 

Physical Acts Which Constitute Aiding the Enemy. From the wording of the article 
and interpretation by the Court of Military Appeals, there are three physical acts 
which constitute the crime of aiding the enemy. Any one of these acts, with 
general criminal intent, is a violation of the article: 

* Aids, or attempts to aid the enemy with arms, ammunition, supplies, money 
or other things. 

* Without proper authority, knowingly harbors or protects or give 
intelligence to or communicates or corresponds with or holds any 
intercourse with the enemy, either directly or indirectly. 
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Proof Requirements Under Article 104. It is necessary to prove only that one or 
more of the prohibited acts actually occurred. The enemy need not be a declared 
enemy but may be a "substantial" enemy as in the case of the communist forces in 
the Korean or Vietnam conflicts. 

The requirements of proving allegiance and proving the overt act by two witnesses 
which are essential under the federal treason statute do not apply. 

Korean Conflict Cases Under Article 104. Article 104 was used in the majority of 
the courts-martial cases arising from the Korean prisoner of war incidents. Most 
of the specifications in these cases concerned the third act listed above and 
specifically that part of the act making correspondence, without proper authority, 
a crime. The Court of Military Appeals established in these cases that there are 

only three types of communication with the enemy which may be made with "proper 

authority" under military law, regardless of the motives which prompt the 
communication: 

* A communication disclosing name, rank. Social Security Number (SSN), and 
date of birth. 

* A communication concerning the necessities of life. 

* A communication concerning regulations and orders of the place of 

confinement. 


Conduct of Treason Investigations (CTI) . Counterintelligence CTI cases in which 
treason is alleged or suspected during times of war are more apt to be opened 
immediately upon the conclusion of hostilities. Allegations of treason may 
originate with liberated prisoners of war, interned U.S. civilians, examination of 
captured enemy records, or interrogation of enemy military and civilian personnel. 
Treason cases will almost always be personal subject rather than incident-type 
cases. Unlike most other CTI, the investigation of a treason case will be 
primarily concerned with obtaining evidence of the past rather than current 
activities of the suspected or accused person. 


Records examination, interview, and interrogation normally will be the principal 
investigative techniques. The Cl Agent must give particular attention to the legal 
requirement governing the collection and preservation of evidence, especially the 
taking of statements from witnesses and suspects. The Cl Agent must be careful to 
sort out fact from rumor or hearsay when taking testimony and reporting the 
results. In many cases, it will be necessary for the investigator to consult 
regularly with legal authorities during the course of the investigation to ensure 
the elements of proof are being fulfilled and all applicable legal conditions and 
restrictions are met. 


PART D: SEDITION 


ELEMENTS OF SEDITION , 
inciting to rebellion 
or suspected sedition 
as the Smith Act), or 


Sedition may be generally defined as "conduct or language 
against the authority of the state." CTI regarding alleged 
may be based either on Section 2385, Title 18, USC (also know 
Article 94, UCMJ, Mutiny or Sedition. 
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Sedition cases may be classified as either incident-type cases, such as the 
discovery of literature advocating the violent overthrow of the US government, or 
personal subject cases, such as the distribution of such literature by a known 
person. Leads by control offices may originate from several sources, reports from 
other agencies, or information developed during the course of routine Background 
Investigation. CTI involving sedition may occur with equal frequency in either 
peacetime or wartime. 

Anyone who conspires to overthrow the U.S. government commits a specific crime 

under the provisions of Section 2384, Title 18, USC. Unlike the general conspiracy 

statute, which makes it a crime to conspire to commit any federal crime, the 

seditious conspiracy stature does not require the commission of an overt act toward 

fulfillment of the conspiracy's objective. The crime of seditious conspiracy is 
complete when two or more persons have entered into an agreement to overthrow the 
U.S. government, or to prevent, hinder, or delay the execution of any U.S. law. It 
should be noted seditious conspiracy is a conspiracy to actually overthrow as 
distinct from a conspiracy to advocate overthrow. 

The Smith Act enumerates the specific types of prohibited activity which, if done 
with "intent to cause the overthrow of the government by force or violence," 
constitute sedition: 

* Advocating action or teaching the duty or necessity of such overthrow. 

* Using words to incite imminent lawless action with the specific intent of 
overthrowing the U.S. government. 

Court decisions relative to advocacy or overthrow have established that advocacy 
must be calculated to incite persons to take action toward the violent overthrow of 
the government. Mere advocacy or teaching of forcible overthrow of the government 
as an abstract principle, divorced from any effort to instigate action to that end, 
does not constitute the crime of sedition under the Smith Act. The requirement for 
the advocacy to "incite persons to take action" is of particular significance to 
the Cl Agent. In cases alleging violation of the Smith Act, it can be expected 
considerable effort will be directed toward proving the oral or written material 
involved was intended to incite listeners or readers to take action. 

Article 94, UCMJ, pertains to both sedition and mutiny. Article 94 makes it a 
crime for "any person to this chapter who, with the intent to cause the overthrow 
or destruction of lawful civil authority, creates in concert with any other person, 
a revolt, violence, or other disturbance against such authority is guilty of 
sedition." The investigation of charges of sedition under Article 94 will usually 
be assigned to Cl personnel. 

Mutiny charges under Article 94 may include a collective effort to overthrow lawful 
military authority, or the individual creation of a riot or disturbance with the 
intent to overthrow lawful military authority. The offense of mutiny may be 
committed in either of two ways: by several persons acting in concert to refuse to 
obey orders from proper authority with the intent to override military authority or 
by a person, with similar intent, acting either alone or in concert with others, 
creating a violence or disturbance. The investigation of mutiny incidents normally 
will not be assigned to Cl personnel unless the mutiny is believed to be related to 
hostile intelligence or subversive activity. 


2-17 


IT0735 



During the conduct of sedition complaint-type investigations, several principles 
apply. These include the facts that covert investigative techniques are usually 
most applicable, but that standard interview and interrogation techniques should 
also be used. Also, the Cl Agent should be thoroughly knowledgeable of the 
complaint area as it is related to subversive activities, subversive individuals, 
and subversive organizations. Such knowledge will greatly facilitate the sedition 
investigations concerning methods of operation, identity of personnel and 
organizations. Additional techniques which may be applied during the conduct of 
sedition investigations can be found in FM 34-60A(S). 

Enlistment to serve against United States - Title 18, USC Section 2390. 

"Whoever enlists or is engaged within the United States or in any place 
subject to the jurisdiction thereof, with intent to serve in armed hostility 
against the United States . . ." 


PART E: SUBVERSION 

ELEMENTS OF SUBVERSION . Under neither constitutional nor statutory law does the 
U.S. recognize subversion as a punishable offense, unless the subversive act is 
directed against members of the U.S. forces. What is often called subversive 
activity is not illegal and could be defended under the First Amendment to the 
Constitution which guarantees the right of free speech. 

Although subversion is not "clearly illegal", it is not any less of a threat to our 
national security than the crimes of espionage or sabotage. Both of these illegal 
acts are criminal offenses because the exact nature of these activities is 
contained in federal criminal statutes and the UCMJ. Accordingly, an investigator 
knows exactly what constitutes these crimes and can judge his course of action. 
However, the obscure nature of subversion makes it difficult to detect, and to 
decide on a course of action once its presence is suspected or detected. The 
threat from subversion assumes greater proportions when the connection between 
subversive activity and the crimes of espionage and sabotage are considered. By 
subverting the loyalty of the citizens of a nation, a hostile power can achieve the 
objective of weakening that country's resistance to aggression and can provide 
itself with a pool of potential espionage agents and saboteurs. 

From the Cl point of view, the Cl Agent must remain constantly alert to such 
activities, as well as the activities of any foreign power which pose a threat to 
military security, operations, and personnel. Subversion covers a broad spectrum 
of activity, all of which is clearly inconsistent with the best interest of 
national security. 

Section 2387(a), Title 18, USC defines criminal subversion as: 

"Whoever, with intent to interfere with, impair, or influence the 
loyalty, morale or discipline of the military or naval forces of the 
United States: 

(1) Advises, counsels, urges, or in any manner causes or attempts to 
cause insubordination, disloyalty, mutiny, or refusal of duty by any 
member of the military or naval forces of the United States; or 
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(2) Distributes or attempts to distribute any written or printed matter 
which advises, counsels, or urges insubordination, disloyalty, mutiny, 
or refusal of duty by any member of the military or naval forces of the 
United States." 

American constitutional law requires that any penal statute fix ascertainable 
guilt, either forbidding specific acts or in some cases placing an obligation to 
perform some specific act. The offense and the elements instituting the act must 
be sufficiently clear so the ordinary person can intelligently choose in advance 
which course he may lawfully pursue. 

On the surface. Section 2387(a), Title 18, USC is very clear, but upon analyzing 
the law, there is no clear standard for judging exactly what subversion is. One 
important question remains constant concerning the obscure treatment of the term 
subversion: "At what point does an individual exercising his right to free speech 

influence the loyalty, morale, or discipline of a member of the armed forces? 

As Assistant Chief of Staff for Intelligence, Department of the Army (ACSI, DA), 
Major General Harold R. Aaron probably best described the current position of Cl in 
investigating subversive activities: 

"The Army wholly endorses the Constitutional principle of freedom of 
expression. Furthermore, the Army has undertaken very practical 

measures to ensure that nothing curtails the soldier's right to express 
any opinion he desires through whatever legal means he chooses. 

On the other hand. Army counterintelligence would be derelict in its 
duty if it did not remain alert to detect security threats from those 
who would abuse the constitutional right of freedom of expression, by 
promoting aims and objectives meant to undermine the soldier's loyalty 
and respect for authority and to reduce the Army's capability to 
fulfill its mission." 

AR 381-20, based on federal statutes, specifies that the suspect must be actively 
attempting to undermine a soldier's loyalty and respect with willful intent. The 
burden of proof to meet this requirement is extremely difficult to fulfill. Also, 
under the UCMJ, no specific article addresses subversion. The armed forces would 
have to invoke Article 92 and/or Article 134, UCMJ, if one of its members were to 
be punished for subversive activities. 

The element of intent and the statutory standards of individual conduct in areas of 
subversive activity are not clear cut. As a result, the Cl investigator must be 
diligent, perceptive, and precise in his efforts and findings. 

Many subversion cases will be based on adverse loyalty information developed during 
a routine BI, Subversion and Espionage Directed Against U.S. Army (SAEDA) reports 
submitted by military or civilian personnel under AR 381-12, reports from other 
intelligence and security agencies, and leads obtained directly from sources used 
in Cl special operations. Note the terminology "criminal subversion," "subversive 
activity," and "subversion' are clues to the Cl Agent to turn to Section 2387 of 
Title 18, USC, for detailed elements of the crime. The objective of such CTI will 
usually be to determine if there is a need for some type of administrative action; 
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for example, removal from a sensitive assignment to protect the security of the 
military command. 

Other statutes and laws pertaining to acts of subversion . Sections 2387 and 2388 
of Title 18, USC, prohibit speeches and acts made to cause mutiny, cause 
insubordination, lower the morale in the military forces, or interfere with 
recruitment. Section 2388 additionally prohibits, during wartime, the spreading of 
false rumors to interfere with the war effort. Under these statutes, the 
government is not required in criminal prosecutions to prove the acts intended by 
the accused actually occurred. The government would have to show two things: 

* An intent on the part of the accused to bring about the criminal objective. 

* The speeches and acts were of such a nature that one could reasonably 
infer such speech or acts would cause mutiny, insubordination, or the 
lowering of morale. 

A Cl investigation of subversive activity must determine conclusively what act 
occurred; establish that the activity was detrimental to the national security, 
based on evidence of prohibitive nature; and establish that the activity did not 
rise to the level of treason, espionage, sabotage, or sedition. 

OTHER ACTIVITIES WHICH MAY WARRANT INVESTIGATION . When a person, who is considered 
by the major commander concerned to be knowledgeable of classified information (as 
defined by AR 380-5), is in the absent without leave (AWOL) status (special 
category absentee (SCA)) the absentee's commander will submit an electrical message 
through intelligence channels. Investigative action in such cases is directed 
toward determining the circumstances surrounding the absence and what, if any, 
classified information could be compromised. Inquiry into the circumstances will 
seek to learn if there was any intent to defect and if any subversive elements, 
hostile propaganda, or an intelligence recruiting effort were involved. 

A Cl debriefing of returned SCA is required. Upon return of an absentee/deserter, 
the intelligence officer of the individual's unit will report his presence to the 
nearest supporting Cl unit. The Cl units will, in turn, determine if the 
individual is a SCA and, if appropriate, conduct the debriefing. 

When a military person absents himself from his unit and seeks asylum in a foreign 
country, he is identified as Military Absentees in, or Attempting to go to, a 
Foreign Country or Embassy (MAFOR). MAFOR is defined as "any person who absents 
himself from his unit and seeks political asylum in a foreign country or embassy, 
or is voluntarily residing in a foreign country." This includes persons who have 
attempted to take this action. It also includes those instances where credible 
information is reported or developed that the individual intends to take such 
action. It does not include a person stationed in a foreign country who absents 
himself in the same country unless he seeks political asylum in that country. 
Although primarily applied to military personnel, DA civilians who meet this 
definition are also considered MAFOR. 

While a MAFOR may not be a SCA, investigating and debriefing procedures and 
objectives are the same as for SCA. If the MAFOR seeks asylum in a foreign country 
with interest harmful to those of the U.S., he is considered a defector. 
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LESSON 2 


PRACTICE EXERCISE 

The following items will test your grasp of the material covered in this lesson. 
There is only one correct answer for each item. When you have completed the 
exercise, check your answers with the answer key that follows. If you answer any 
item incorrectly, study again that part of the lesson which contains the portion 
involved. 

1. Which is an example of a sabotage target? 


A. 

Bridge. 



B. 

Tunnel. 



C. 

Supply dump. 



D. 

All of the above. 



Are Cl Agents tasked with investigating incidents 
expected to be technical experts in the chemistry 

of possible sabotage 
of fires and explosives? 

A. 

Yes. 



B. 

No. 



The objective of all espionage investigations is 
evidence to arrest and prosecute the offender. 

to obtain 

sufficient 

A. 

True. 



B. 

False. 



Loss through gross negligence and "failure to promptly reports is considered 
a crime of what? 

A. 

Omission. 



B. 

Remission. 



C. 

Commission. 



D. 

Submission. 
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5. 


6 . 


When would an investigation, in which treason is alleged to have occurred, 
most likely be conducted? 

A. Immediately prior to hostilities. 

B. During hostilities. 

C. Immediately after hostilities. 

D. As soon as the crime of treason is alleged. 

CII involving sedition will occur only during wartime. 

A. True. 

B. False. 


7. Which article of the UCMJ covers mutiny? 


A. 

5. 

B. 

28 . 

C. 

94 . 

D. 

137 


8. The definition of subversion included in Section 2387 of the United States 
Code is clear and specific; therefore. Cl Agents would have no problems 
obtaining sufficient evidence to obtain a conviction of any person charged 
with the offense of criminal subversion. 

A. True. 

B. False. 
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LESSON 2 


PRACTICE EXERCISE 
Answer Key and Feedback 
Item Correct Answer and Feedback 

1. D. All of the above. (page 2-3). 

2. B. No. (page 2-8). 

3. B. False. (page 2-13) . 

4. A. Omission. (page 2-12) . 

5. C. Immediately after hostilities. (page 2-16). 

6. B. False. (page 2-16) . 

7. C. 94. (page 2-17) . 

8. B. False. (page 2-18/2-19). 
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LESSON 3 


PHYSICAL EVIDENCE 

CRITICAL TASKS: 301-340-1002 
301-340-1100 

OVERVIEW 

LESSON DESCRIPTION: 

In this lesson, you will learn how to identify physical evidence of Cl interest; to 

preserve a crime scene through photography and/or sketches; and to fulfill all 

requirements for the handling of physical evidence to include admission before a 

judicial proceeding. 

TERMINAL LEARNING OBJECTIVE: 

ACTIONS: Identify physical evidence of Cl interest; prepare sketches; take 

photographs; prepare evidence tags; account for, store, release, and 
dispose of evidence; and process a crime scene. 

CONDITIONS: You will be given narrative information and illustrations from 

FM 34-60 and FM 19-20. 

STANDARDS: You will process physical evidence of Cl interest IAW the 

provisions of STP 34-97B14-SM-TG. 

REFERENCES: The material contained in this lesson was derived from the following 

publications: 

AR 55-355 
AR 190-22 
AR 195-2 
AR 195-5. 

AR 380-5 
AR 710-2 
FM 19-20 
FM 34-60 
STP 34-97B1 
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This lesson has two parts: 


Part A: Physical Evidence of Cl Significance. 

Part B. Account for. Store, Release, and Dispose of Evidence. 

PART A: PHYSICAL EVIDENCE OF Cl SIGNIFICANCE. 

Physical evidence is tangible in nature and recognizable in form. It tends to 
prove or disprove a fact in dispute. It includes all articles and materials 
collected in connection with an investigation to establish the identity of the 
perpetrator and the circumstances under which an incident occurred. The articles 
and materials are used to aid in the prosecution of the offender or to terminate 
the case. 

The importance of physical evidence, which may be encountered in any type of Cl 
operation, is not limited to those investigations likely to result in a trial. 
Physical evidence of probative value is often essential to the proper determination 
of administrative actions such as the granting of a security clearance, the 
issuance of a visa for entry into the U.S., or the admission of an alien into the 
armed forces. 

Cl Agents are not expected to be experts on physical evidence. The analysis of 
various substances normally will require the services of one or more specialists 
such as ballistics experts, chemists, and fingerprint technicians to fully identify 
the substance and its relationship to the crime. However, as a Cl Agent, you 
should have a general knowledge of the value, limitations, and characteristics of 
physical evidence and be able to recognize, collect, handle, and preserve evidence 
encountered during the course of an investigation. 

Documentary Evidence . Documents are the most common items of physical evidence 
encountered by Cl. Manuscripts, magnetic tapes, records, files, reports, sworn 
statements, photographs, video tape movies, pamphlets, maps, sketches, passports, 
identity papers, and similar documents are likely to be collected in Cl operations. 

Questioned Documents . Questioned documents are those whose validity is disputed. 
Chapter 21, FM 19-20, Law Enforcement Investigations, describes various categories 
of questioned documents and types of assistance available for criminal 
investigation experts and laboratories. This assistance may be obtained through 
liaison with the appropriate provost marshal's office. 

Documents Containing Codes and Ciphers . Codes and ciphers (cryptography) are often 
used in communication between operational elements of espionage agencies. Unless 
the key to the system has been obtained, the investigator should not expend any 
time attempting to decrypt the message. The investigator should provide along with 
a history of the circumstances under which it was obtained and a brief summary of 
the related investigation, the document should be processed in accordance with the 
unit standing operating procedures (SOP). 

You should also be familiar with the procedures of your unit for obtaining the 
assistance of appropriate experts and laboratory facilities. It should be noted 
that some of the information 
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presented in this lesson pertains to strictly criminal investigations. However, as 
a Cl Agent, you should be familiar with the overall procedures for handling 
evidence. 

Documents Suspected of Containing Secret Writing. Secret writing or the 
concealment from visible detection of written material by means of invisible inks, 
specially treated papers, microphotography, and similar systems are also important 
facets of espionage communication systems. Documents taken from espionage 
suspects, or otherwise obtained under conditions indicating the possible presence 
of secret writing, should be tested for indications of secret writing. No attempts 
should be made to recover any secret text. The material should be forwarded to a 
facility or agency where the expertise is available. 

Other Types of Evidence . Traces and clues often may be found in the form of latent 
fingerprints; firearms and ammunition; indentations made by tools, tires, or shoes; 
and from deposits of foreign substances such as fibers, soils, and stains. 

Fingerprints. Fingerprints evidence is the most positive means of identifying 
individuals, since they never change throughout a person's lifetime. Surface 
fingerprints can be transferred, photographed, and developed by various techniques, 
thus providing invaluable evidence for purposes of identification. Detailed 
consideration of fingerprint patterns and methods of collection and preservation 
are included in chapter 7 of FM 19-20. 

Indentations and Fractures. Physical impressions and indentations left in various 
media are often of value as evidence. Examples would be footprints, tool marks, 
and tire imprints. Collection and preservation methods are included in Chapter 8, 
FM 19-20. 

Tire imprints may identify a particular vehicle by association of the brand, amount 
of wear, and unique scars. Direction of travel can often be determined from the 
direction in which sand, soil, or water was thrown; speed of the vehicle from the 
distinctiveness of the track; and the weight of the load from the depth of the 
track. 

Footprints may reveal direction and speed of movement, sex, approximate height and 
weight, and physical deformities. In addition, the brand of footwear may be 
apparent and provide additional leads. 

Firearms and bullets have individual characteristics subject to scientific 
examination for identification purposes. Each firearm and bullet fired therefrom 
have individual characteristics which may be detected by expert examination under a 
microscope. The weapon will have on it the name of the manufacturer, a trademark, 
serial number, and possibly fingerprints or distinctive features. When discharged, 
a cartridge casing and bullet will have such characteristics as scratches or 
indentations associating them specifically with a particular weapon. Collection 
and preservation methods are discussed in Chapter 9, FM 19-20. 

If examined by an expert, glass fractures may reveal the direction of the blow or 
the type of instrument used to break the glass. The nature of a projectile which 
pierced the glass can sometimes be identified. Since each type of glass has 
peculiar characteristics, examination may serve to identify the glass manufacturer 
and thus provide leads in some investigative situations. Chapter 10, FM 19-20. 
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Trace Evidence is evidence which is examined and attested to, by laboratory 
examiners to be admissing in court. Trace items include: 

Fibers. Hairs and fibers have distinctive characteristics which may be useful in 
identification. They may be classified as animal, vegetable, mineral, and 
synthetic. 

Animal fibers include hair, wool, silk, and fur. Each type can be distinguished 
from another, and many types have individual characteristics which permit further 
differentiation. By study of the diameter and texture of a human hair, for 
example, determination can sometimes be made of the race, sex, and general age of 
the individual. 

Vegetable fibers include cotton, linen. Jute, and sisal, each of which has its own 
distinctive characteristics such as color of dye and number of strands per thread. 

Mineral fibers include glass and asbestos. 

Synthetics have expanded much beyond the well-known rayon and nylon, but can be 
distinguished from one another by laboratory analysis. 

Soil and Stains. Samples of soil can provide information of value when examined 
microscopically and chemically. Study may indicate a difference between soil and 
dust, the latter being composed chiefly of vegetable fibers. Soil analysis may 
reveal the geological source or general origin, and at times a specific area of 
origin. Stains resulting from any cause are susceptible to analysis in a 
laboratory. They may be identified as food, vegetable matter, grease, oil, paint, 
rust, or body fluids. 

Laundry Marks. Dry cleaning, laundry, and other clothing or linen marks, whether 
they be made with indelible or invisible ink, may provide valuable clues in 
identification. Police usually maintain records which can help with this type of 
identification. 

Detective Dyes. Police at times use dyes and florescent powders which can be 
dusted or sprayed on items likely to be handled by suspects. Some of these are 
virtually indelible; others are invisible, but susceptible to detection under 
ultraviolet light for prolonged periods after contact. 

Collection and preservation methods are outlined in Chapter 11, FM 19-20. 

PART B: ACCOUNT FOR, STORE, RELEASE, AND DISPOSE OF EVIDENCE. 

HANDLING EVIDENCE . Physical evidence is one of the Cl Agent's most valuable assets 
in pursuing the investigation to a successful conclusion. It produces leads for 
the investigative action during conduct of the investigation. It aids in 
establishing guilt or innocence of an accused person in a court. To achieve the 
maximum benefit from physical evidence, the investigator must not only be skilled 
in its collection, but he must also know how to handle and care for it. The 
evidence must be preserved for the development of leads, for laboratory 
examination, and/or for presentation in court. 

Such handling and care involves: 
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* Storing the evidence to retain the integrity of the item in its original 
condition as nearly as possible. 

* Maintaining a chain of custody for the item to assure responsibility and 
ensure its evidentiary value. 

* Transmitting the item properly to the laboratory for analysis. 

* Disposing of the item when it is no longer of evidentiary value. 
DEFINITION S. 

Evidence . Anything that helps to ascertain the truth of a matter or gives proof of 
a fact. (AR 195-5) . Evidence may be physical or testimonial. 

* Physical Evidence - evidence like identified weapons and fingerprints that 
is obtained by searching crime scenes, tracing leads, and developing 
technical data. 

* Testimonial Evidence - like sworn statements of eyewitness accounts and 
admission of guilt is obtained through communication with people. 

This lesson addresses only physical evidence. Physical evidence is divided into 
two general categories: 

* Movable evidence can be picked up at a crime scene or any other location 
and transported. Examples are tools, weapons, clothing, glass, and 
documents. 

* Fixed or Immovable evidence cannot be readily removed from a scene because 
of its size, shape, or makeup. Examples would be walls, telephone poles, 
and floors. 

Fragile evidence is physical evidence which, if special care is not taken to 
preserve its state, can deteriorate to a point where it is no longer of evidentiary 
value. It may be movable or immovable. A footprint in the snow is actually 
immovable, but a cast of it can be taken and preserved so as to be admissible as 
evidence. Fingerprints can be "lifted" or removed; body fluids can be preserved in 
their natural state or close thereto. 

NOTE: The remaining portion of this lesson addresses the general precepts of 

handling, packaging, and caring for an item of physical evidence after it has been 
collected and until it is disposed of. 

EVALUATING EVIDENCE . The question invariably arises as to whether an object is or 
is not evidence. The investigator resolves this question by evaluating the object, 
in light of the circumstances and conditions you find at the crime scene. You 
evaluate each piece of evidence, individually and collectively, in relation to all 
other evidence. Support your evaluation with common sense and sound judgement 
enhanced by your past experience. If doubt exists, the object is secured and 
processed as evidence. Later evaluation can determine the worth of such evidence 
to the investigation and its ultimate disposition. 
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IDENTIFICATION . The investigator who first receives, recovers, or discovers 
physical evidence must be able to state positively at a later date that the 
specific article or item was obtained in connection with a specific investigation. 
Identification is accomplished when the investigator marks and tags the evidence as 
it is obtained or collected. The investigator should form the habit of marking and 
tagging evidence promptly. 

Markina . The person initially assuming custody of evidence marks it by inscribing 
his initials and the military date and time directly upon individual item(s) of 
physical evidence. Care must be exercised to place the markings so as not to 
destroy any latent characteristics of the item(s) or to reduce its value as 
evidence. The investigator should use Judgment and common sense when determining 
where to mark such item(s). He should first consider how an item is normally 
handled and how it may have been handled during the crime. 

The purpose of marking is to enable the investigator to positively identify the 
object at a later date. The markings should be inconspicuously placed, especially 
when the evidence is recovered stolen property and will be returned to the rightful 
owner. By placing identifying marks in inconspicuous locations, unnecessary 
marring of personal property is avoided. 

When an item of evidence cannot be marked without marring, it is placed in a 
suitable container, which is sealed with a cover and then both the container and 
cover marked for identification. Since evidence such as hair, soil, and fluids 
cannot be marked, they are also placed in suitable containers, which are then 
sealed and marked. 

A carborundum or diamond point pencil is recommended for marking on hard surfaces 
and ink on other items. The investigator then records the marking and its location 
in his notebook. 

Tagging . Tagging further serves to help the investigator to identify evidence. DA 
Form 4002, Evidence/Property Tag, contains pertinent data about the evidence and is 
attached to the article or container (see figure 3-1). 



Figure 3-1. DA Form 4002, Evidence/Property Tag. 
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Evidence must be tagged before it is submitted to the evidence custodian. It 
should be done at the crime scene when the evidence is collected. 

The evidence tag should be completed in ink. The tag aids in the processing and 
handling of evidence by the evidence custodian and the laboratory examiner. Some 
of the information needed to complete DA Form 4002, such as document number or 
MPR/CID sequence number, is extracted from DA Form 4137, Evidence/Property custody 
Document (See Figure 3-2) . 

CHAIN OF CUSTODY . The chain of custody begins when an item of evidence is 
collected and maintained until that evidence is disposed of. The chain of custody 
assures continuous accountability. If it is not properly maintained, an item may 
be inadmissible in court. 

Chain of custody is a chronological written record of those individuals who have 
had custody of the evidence from its initial acquisition until its final 
disposition. Those persons in the chain of custody must be identified on the DA 
Form 4137, Evidence/Property Custody Document, which is initiated when the evidence 
is acquired by the Cl Agent. 

Responsibility . Each Individual in the chain of custody is responsible for that 
item of evidence. This includes it care, safekeeping, and preservation while under 
his control. Because of the sensitive nature of evidence, an evidence custodian is 
provided copies of DA Form 4137 to assume responsibility for the evidence when it 
is not needed by the investigator or other competent authority such as a lawyer 
involved in the investigation. 

Evidence/Propertv Custody Document DA Form 413 . This form is used to record 
acquisition, chain of custody, and disposition of evidence. This form is hereafter 
referred to as the custody document. It is a multiple-purpose form designed to be 
used as a receipt and record the chain of custody, authority for final disposition, 
and witnessing of destruction. The form is normally prepared with an original and 
three copies. Entries should be typed or printed legibly in ink. (Figure 3-2) 

The last or third copy is used as a receipt when evidence is received from a 
person. The original and first two copies go to the evidence custodian. He keeps 
the original and first copy for his records. The second copy is returned to the Cl 
Agent for inclusion in the case file. 

Individual blocks on the Evidence/Property Custody Document should contain the 
following information: 

MPR/CID SEQUENCE NUMBER and CID ROI NUMBER blocks are completed LAW local 
unit SOP. 

RECEIVING ACTIVITY block contains the name of the office or organization 
conducting the investigation. 

LOCATION block contains the installation or base where the office or 
organization conducting the investigation is located. 
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NAME, GRADE, AND TITLE OF PERSON FROM WHOM RECEIVED block is completed when 
evidence is received from an individual rather than from a crime scene. When 
evidence is obtained from an individual, the OWNER or OTHER block is checked. 

When evidence is not received from an individual, an appropriate term such as 
"crime scene" or "found" is entered in this block, and the OTHER block 
checked. 

ADDRESS block holds the address of the individual from whom the evidence is 
obtained. If the evidence is not received from an individual, this block is 
annotated "NA". 

LOCATION FROM WHERE OBTAINED block holds the location of the evidence at the 
time it was acquired by the Cl Agent. It may be further augmented by a crime 
scene sketch. 

REASON OBTAINED block is completed by the word "Evidence" when the item is 
obtained as possible evidence. 

TIME AND DATE OBTAINED block contains the military date and time the evidence 
was acquired by the Cl Agent such as "2150, 4 May 90". 

ITEM NUMBER block contains a chronological numbering of the separate items 
appearing on the form which corresponds with the item number shown on the 
evidence tag. Each item should be assigned a separate item number. When 
similar items pertaining to the same investigation are not grouped together, 
it is advisable to list them as separate items. An example would be 
cartridge casings of the same caliber found in separate locations within the 
same room. This will facilitate identification by matching the specific item 
number on the evidence custody document with the evidence tag attached to the 
item. In cases where like items are found at the same place, but are already 
grouped when received by the Cl Agent, one entry number is sufficient. 

QUANTITY block contains the number of items included in each entry. 

DESCRIPTION OF ARTICLES block holds a description of each item of evidence. 

It is detailed accurately and in detail based upon what is actually observed 
about the object at the time it is acquired. The item's physical 
characteristics and condition, especially if the item is valuable, are 
described. The value of articles is never estimated or listed, nor is the 
type of metal or stone (in the case of jewelry or similar items) stated 
beyond giving color, size, and configuration. For example, an article 
appearing to be gold is listed as "gold colored metal". Serial numbers are 
listed whenever possible. The words "LAST ITEM" are placed in capital 
letters after the last item listed. These words are centered on the page and 
solid lines are drawn from the words to the margin on each side of the form. 

CHAIN OF CUSTODY block has item numbers, date, released by, received by, and 
purpose of change of custody. The first entry under RELEASED BY is the name 
and signature of the individual from whom the property was taker Should the 
individual 
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refuse or be unable to sign, the individual's name is entered in lieu of 
signature. When the evidence is obtained directly from a crime scene or 
found by the Cl Agent, the first RELEASED BY block contains "NA". The first 
entry under RECEIVED BY is the Cl Agent receiving the property. The purpose 
of change of custody is described briefly, such as "Evaluation as Evidence" 
or "Release to Evidence Custodian". This procedure is followed each time 
there is a custody change. When the Cl Agent initially receiving the 
evidence is also the evidence custodian, the first RECEIVED BY block is 
completed by the custodian (Cl Agent) and the purpose of the change of 
custody block is, "Received by Evidence Custodian". An original signature is 
not necessary on all copies of an evidence custody document; however, when 
signing through carbons, be sure the signature is legible on all copies. If 
and when any change of custody occurs, it is the responsibility of the person 
in control of the evidence at that time to ensure that entries of the change 
are made on the original DA Form 4137, and all appropriate copies. The 
importance of keeping accurate and complete custody documents cannot be 
overemphasized. 

FINAL DISPOSAL ACTION block is used by the evidence custodian and approving 
authority in making final disposition of the evidence. This section will 
normally be completed by the evidence custodian prior to requesting final 
disposal authority. However, the Cl Agent, initially acquiring the evidence, 
may enter this information in pencil if such disposal action can be 
anticipated. Any penciled entries must be verified by the evidence custodian 
and be printed in ink or typed before requesting approval for disposition. 

The Cl Agent assists the custodian's later disposition of the evidence by 
completing this section. This is especially helpful in cases of release to an 
owner when the owner's name does not appear elsewhere on the form. The item number 
and name and unit of the person to receive evidence are entered after the RELEASE 
TO OWNER OR OTHER line, such as "Item 1-Owner-SPC Charles Smith, B Co, 2d Bn, 1st 
Tng Bde". For evidence which will be destroyed, such as controlled substances, the 
item number and method of destruction are indicated, such as "Item 3 - released to 
US Secret Service, Final Disposition". 

FINAL DISPOSAL AUTHORITY is completed when the evidence is of no further 
value. The first portion of this section is completed by the evidence 
custodian, and the second portion is completed by the individual authorized 
to grant final disposal. 

WITNESS TO DESTRUCTION OF EVIDENCE is completed for any evidence destroyed. 

A witness attests to the destruction by placing his name, organization, and 
signature in this section. In the CHAIN OF CUSTODY section, the evidence 
custodian enters the item number of the evidence destroyed, date destroyed, 
and his name and signature. The word "Destroyed" is placed in the RECEIVED 
BY column. 

The location of evidence while in the depository is written in pencil in the bottom 
margin, such as "Safe 1, Shelf 1." The document number, a two-part number, 
assigned chronologically, is reflected in the space provided such as "1-90" and 
represents the first evidence custody document received by the evidence custodian 
for the year 1990. 
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Figure 3-3. DA Form 4137 (Concluded). 
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EVIDENCE LEDGER . This is a bound record book (FSN 7530-00-286-8363) kept by the 
evidence custodian to provide double accountability and to cross-referenced custody 
documents. Ledgers will be destroyed three years after final disposition has been 
made of all items entered in each ledger. The ledger is prepared with the 
following six columns (see Figure 3-4). 

* Document number and date received. Contains the document number assigned 
to the evidence custody document. The date the DA 4137 was received in 
the evidence room is entered below this number. 

* MRP number or CID sequence number. The number assigned to the 
investigation the evidence pertains to. For Cl officers maintaining their 
own evidence facility, utilize the column IAW local SOP. 

* Brief description of evidence. A brief description is entered. Include 
the item number from the DA 4137. 

* Date of final disposition. Date the evidence as disposed of, as shown in 
"Chain of Custody" section of DA 4137. When several items are not 
disposed of on the same date, the date of disposition should be shown 
opposite its description. 

* Final disposition. A brief note on the means of final disposition is 
entered. 

* Remarks. Evidence custodian can record any information he/she thinks is 
necessary. 


1 1 

Document No 
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Figure 3-4. Evidence Ledger Sample. 
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PHOTOGRAPHY AS EVIDENCE . A photograph may be valuable as evidence since it 
presents facts in pictorial form and creates mental impressions more vivid and 
realistic than those achieved by words alone. It presents evidence more accurately 
than the verbal description and permits consideration of evidence which, because of 
size, bulk, weight, or condition, cannot be brought into the courtroom. A 
photograph also reduces the need for lengthy descriptions and explanations. 

Rules Pertaining to Photographs as Evidence. In order to qualify for admissibility 
as evidence, photographs must have been made in accordance with the following 
general rules: 

* The represented object must be material to the case under trial. 

* The photograph must be free of distortion. 

* It must be verified by a person who is personally acquainted with the 
locality, object, person, or thing represented and who is able to state 
that the photograph represents the appearance of the subject matter in 
question. 

* Nothing must be removed or altered at the scene of an incident prior to 
the taking of the photograph unless absolutely necessary; then, a note 
should be made indicating the reason for the removal or alteration. 

* Although not a prerequisite for admissibility as evidence, photographs 
should be supported by notes made at the time of photography. The notes 
provide a description of what the photograph includes: case number or name 
of the subject; time and date; lighting and weather conditions; plate, 
film, lens, and type of camera; time of exposure and stop used; specific 
reason for taking the photo; location of the camera; compass direction; 
and specific reference to all important objects portrayed. Any one of 
these details may be important during a trial, particularly if the 
photograph is challenged. The notes should be retained by the 
investigator (photographer) in format similar to the Photo Data Card shown 
in figure 3-5. 

Further information on the use of photography is found in appendix A. 
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PHOTO DATA CARD 


Case number: 


Subject: 


Photographer 


Location: 


Time of Day: 


Weather Conditions: 


Camera: 


Negative Size: 


Lens (Type) . 


Focal Length: 


Diaphragm Setting: 


Shutter Setting: 


Filter. 


CAMERA POSmONS 


A. Compass R.ec iinc: 


B. Heicnt: 


C. Lateral Position: 


D. Tilt: 


Artificial Light Used: 


Developer. 


Developing Time: 


Temperature: 


Agitation: 


Method of Printing. 


Contrast: 


Enlarger Lens: 


Paper: _ 

Distance between Important Objects in View: 


Description of Area: 


Remarks: 


Figure 3-5. Photo Data Card. 
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EVIDENCE TRANSMITTAL. 


Transmittal Methods. 

The method used to transmit evidence to the crime labs depends on the type of 
evidence and how urgently the results are needed. There are three methods: first 
class registered mail, handcarry, transported by Government carrier. 

Wrapping, Packaging, and Transmitting. 

A package wrapped for shipment to the laboratory consists of evidence from only one 
investigation. Each item of evidence within the shipping container should be in 
its own separate package. Violation of this procedure can result in contamination 
of evidence and problems in chain of custody. 

Pack each item of evidence that will minimize friction and prevent shifting, 
breaking, leaking, or contact with other evidence. Pack in cotton or soft paper 
items that are particularly susceptible to being broken, marred, or damaged. 

Items such as glass fragments, evidence in glass containers, impressions, casts, 
ammunition, bullets, cartridge cases, tablets, and capsules particularly 
susceptible to breaking, should be packed in cotton or soft paper. 

Fingerprints . When evidence is to be examined for fingerprints, each item of 
evidence should be packed in a manner that prevents damage to the fingerprints. 

This is accomplished by fastening the object in the container so it will not shift. 
No other object may come in contact with the object suspected of containing 
fingerprints. Items should be dry before packaging. 

The nature of the evidence will govern the use of warning notices to be affixed to 
the outside wrapper or box, such as "Fragile", "Expedite", or "Corrosive". 

Stains . Items that contain stains, such as clothing with stains of blood or other 
body fluids, should not be placed in airtight plastic containers, 'sweating" and 
moisture accumulation may result within such containers, contaminating the 
evidence. Such items must be dry before packaging. 

Liquids . Liquid evidence, with the exception of explosives, oils, and gasoline, 
should be packed in all-glass, sterile bottles or other containers and sealed with 
wax or other suitable material. 

Small Obiects . In general, small solid items, such as bullets, fibers, hair, paint 
scrapings, powder, powder patterns, and threads should be placed upon a piece of 
plain paper; the paper folded. This should be packed in separate pill or powder 
boxes, paper containers or druggist folds and sealed with adhesive tape, wax, or 
other suitable material. 

Paper or String . Documents, string, twine, and rope should be placed in an inner ce 
llophane envelope and an outer manila envelope. Cellophane is not suitable for 
packing any item which will rust or corrode. 
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Materials bearing traces of accelerants like those recovered in an arson or sabotage 
investigation should be sealed in a vapor tight container such as a mason jar. 

They should not be sent in plastic bags because accelerants will leak through 
plastic. 

Growing plant material should not be placed in airtight plastic containers as 
moisture accumulates, making examination difficult. Growing plants should either 
be dried before shipment or wrapped in porous paper. The laboratory should be 
notified in advance of the shipment. 

Packages containing items of evidence that require careful or selective handling 
while in transit label "Corrosive", "Fragile", "Keep Away From Fire", or "Keep 
Cool" . 

Federal laws prohibit transmitting certain items through postal channels. If there 
is any question of mailing, the nearest postmaster should be consulted. 

Chemicals, gases, unexploded bombs, detonators, fuses, blasting caps, and other 
explosive or inflammable materials cannot be sent by mail. Transmittal of these 
items of evidence must conform to the provisions of AR 55-355, Military Traffic 
Movement Regulation; Interstate Commerce Commission regulations; and appropriate 
state laws and municipal ordinances. 

Before such items are forwarded, the laboratory must be notified the shipment is 
planned and must acknowledge receipt of notification. In your notification give 
details of how the materials are packed. This will reduce the danger involved in 
unpacking those items at the laboratory. 

NOTE: More details can be found in appendix B of this manual or refer to the 

appendix in FM 19-20 for further details. 

Transmittal of Classified Evidence . For transmittal of classified evidence three 
wrappers should be used: 

* Inner wrapper. The sealed container is wrapped and property sealed. The 
full address and return address of the transmitting agency should be 
placed on the wrapper. When appropriate, the notation "evidence-to be 
opened by laboratory personnel only" and the classification of contents 
are placed on all six sides of the package. An envelope containing two 
additional copies of the evidence receipts, plus two copies of DA Form 
3655, Crime Lab Examination Request, should be affixed to the inner 
wrapper. 

* Middle wrapper. The package is then wrapped and sealed a second time. The 

markings are the same as for the inner wrapper, except no notation is 
made that the package contains evidence. 

* Outer wrapper. The package is then wrapped a third time and again sealed. 
The outer wrapper bears only the two addresses; however, a special 
handling notation must be made if the evidence is perishable, flammable, 
fragile, explosive, corrodible, or corrosive. 

Submitting Evidence to a Crime Lab . The following steps must be followed when prepa 
ring evidence for submission to a crime lab: 

* DA Form 3655, Crime Lab Examination Request (Figures 3-6 and 3-7), is 
completed in an original and two copies. One copy is maintained in the 
investigative case file. 

* Each item of evidence is labeled to correspond with the entries on DA Form 
3655 and packed securely in a box. Documentary evidence may be placed in 
an envelope or series of envelopes which are in turn placed in another 
envelope. Each item of evidence must be wrapped separately. 

* The box or envelope containing the evidence is sealed with tape or glue. 
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CRIME LAB EXAMINATION REQUEST 

for uu of tfau farm, m AR 19M te proposal tfeoey it ifao 


LAB USE ONLY 


REFERRAL NUMBER 


TO (incindt op coat) 

Commander 
US Army Criminal 


FROM findad top coda) 

Comman der 

FI Benring Field Office 


Investigation Laboratory Third Region, USAC3DC 
Ft Gordon, GA 30905 Ft Bearing, GA 31905 


ATTN: 

Chemistry Division 


RETURNED 


RspiMul RcguMul 


RVEXP RVEXP 



RtcavcdBy 


EVIDENCE RECEIPT 


RECEIVED RECEIVED 


l.Contnbutor Case Number I 2. Investigator’s Name ( 3. Autovon A Phone Number 


4. SUSPECT (S) (Last. .~n : cm mtidlt namait 


5. VISUM (S) (Lart. F)m and 


6. Type of Offense 


7. One Copy of Evidence 8. Other evidence 

Receipt inclosed Previously Submitted 


9. If “YES" in Hems, list other suspect, date submitted, unit case and laboratory referral 
number. 


Figure 3-6. DA Form 3655, Crime Lab Examination Request. (Continued) 


The sender should place his initials or signature across the sealed flap 
of the inner envelope or across the paper tape used to seal the inner box 
and cover his initials or signature with transparent tape. 
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The original and one copy of DA Form 3655 plus the original evide 
custody document are placed in an envelope, which is sealed and a 
to the laboratory with an attention line to the specific division 
(document, fingerprint, firearm, and so on). 

The sealed envelope is securely taped to the box or envelope cont 
evidence. 

The box containing the evidence is than wrapped in heavy paper an 
via first class or registered mail, express, or hand-carried to t 
laboratory. If postal or express channels are used, the evidence 
accompanied by a request for a return receipt from the laboratory 
Form 3811) . 


meow 


I. Determine if Exhibit 1 i* narihoana and the amount thereof 

?. Deter nine If Exhibit 2 contains ISO or any other narcotic or controlled substance 
aitf the Mount thereof. 


Erolrnce above hat not been eaammrd by another expert in the aw leienufK fir Id 
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Temporary Release of Evidence . Evidence may be removed from the evidence room only 
for permanent disposal or temporary release for specific reasons. The most common 
reasons for temporary removal are: 

* Transmittal to a crime laboratory for forensic examination. 

* Presentation at a courts-martial or hearing conducted under Article 32, 
UCMJ. 

The person evidence is released to will sign for it in the "Received By" column on 
the "Chain of Custody" section on the original and first copy of DA Form 4137. The 
person receiving the evidence must safeguard it and maintain the chain of custody 
until it is returned to the evidence custodian. The evidence custodian will 
release the original DA Form 4137 to the person who assumes temporary custody, or 
to first class mail or other transmittal channels, along with the evidence. He 
will then put the first copy of the DA Form 4137 in a suspense folder. When the 
evidence is returned, the original DA Form 4137, properly annotated by the 
custodian and the person returning the evidence, will be put in the evidence 
document file. The first (suspense) copy, with the chain of custody properly 
annotated, will be refiled with the original DA Form 4137. 

When items on the same DA Form 4137 must be temporarily released to more than one 
agency or person at the same time, additional copies will be used and processed as 
above. A note will be made on the original and first copy indicating that 
additional copies have been made. The chain of custody for all evidence will be 
recorded on the first copy of the DA Form 4137. 

Personnel receiving evidence, either on a temporary or a permanent basis, will be 
required to present identification to ensure evidence is only handled by authorized 
persons. 

Transmittal to US Army Criminal Investigation Laboratory (USACIL) . Requests for 
USACIL analysis should be coordinated with and made by the local CIDC elements. 

This will ensure that items of material value or physical evidence in an 
investigation are not mishandled, improperly accounted for, or contaminated. It 
will also ensure USACIL elements are aware of incidents of suspected criminal 
activity as defined in paras 3-1 through 3-3, AR 195-2. 

Even when CID personnel have no direct interest in materials being shipped to 
USACIL, they can still be of assistance by providing proper laboratory request 
forms, addresses, and advice on packaging and transmittal. The date, name, and 
unit of the CID representative coordinated with will be entered in Item 11 of DA 
Form 3655. More detailed instructions pertaining to the release of various items 
of evidence may be found in AR 195-5. 

FINAL DISPOSITION OF EVIDENCE . Evidence will be disposed of as soon as possible 
after it has served its purpose or is determined to be of no value as evidence. 
Evidence released to a trial counsel for judicial proceedings will be returned as 
soon as possible to the custodian for final disposition. If an item of evidence is 
made part of the record of trial, the trial counsel will immediately notify the 
custodian so the DA Form 4137 can be properly annotated. This will be considered 
final disposition. 
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When final action has been taken in known subject cases, the original custody 
document will be sent to the Staff Judge Advocate (SJA) of the commander with 
general courts-martial jurisdiction over the subject. The SJA will complete the 
final disposal authority part of the DA Form 4137 if the evidence is no longer 
needed. When evidence must be retained, this part of the form will not be 
completed; a brief statement giving the reason for keeping the evidence will be 
furnished to the evidence custodian on separate correspondence. In unusual cases, 
where there is a high risk of losing the original DA Form 4137, (for example, 
isolated units that must mail the DA Form 4137 to the servicing SJA for disposition 
approval), a letter or memorandum for record may be substituted for disposition 
approval. When this method is used, enough information will be furnished to allow 
the SJA to make a decision. The return correspondence from the SJA giving 
disposition approval will be attached to the original DA Form 4137 for filing. 

Evidence in an investigation for which no subject has been identified may be 
disposed of 3 months after completion of the investigation without SJA approval; it 
may be disposed of earlier with SJA approval. However, care must be taken with 
serious crime, when it is possible a subject may later be identified. In such a 
case, it may be advisable to keep the evidence longer than 3 months. When the 
subject is not known, evidence custodians will obtain the approval of the 
commander, SJA, provost marshal, or representative, as appropriate. This approval 
will be given by completing the final disposal authority section of the original DA 
Form 4137. 

When evidence is permanently released to an external agency, the final disposal 
authority part of the DA Form 4137 will be completed. This will be considered 
final disposition of the evidence. 

Items in the evidence room that, after laboratory analysis, seem to have no value 
as evidence may be disposed of after consulting with the proper SJA. Items of 
possible evidence that are determined to have no value as evidence by the Cl Agent 
before being sent to the evidence custodian, may be disposed of by the agent; this 
is done only after consulting with the immediate supervisor and getting approval. 
This does not include found controlled substances. In unusual cases, oral approval 
may be obtained followed by written approval. 

When it is not practical or desirable to keep items of evidence, (eg. automobiles, 
serial numbered items, items required for use by the owner, undelivered mail, large 
amounts of money, and perishable or unstable items) disposal action may be taken 
immediately. If such items can be immediately disposed of, it will not be 
necessary to enter them into the evidence room. This will be coordinated with SJA. 
The SJA will complete the final disposal authority portion of the DA Form 4137. If 
it is not possible to get written approval of the SJA before the disposal of the 
evidence, oral permission will be obtained, followed by written approval. 

The guidance below on evidence disposal will be followed. When a legal question on 
methods of disposal comes up, the SJA will give legal advice. 

* (1) U.S. government property will be released to the organization to which 

issued. 

* (2) Personal property that is legal to own will be released to its 
rightful owner. 

* (3) U.S. government treasury checks and money orders from any APO money 
order facility will be returned to the issuing APO. 
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(4) Other types of negotiable instruments (eg. money orders, travelers 
checks, and checks) owned by a business firm will be released to the firm. 
If the firm does not want them returned, they will be destroyed. 

(5) Except as provided for in (3) above, US postal money orders that 
cannot be identified as the property of a specific person will be sent to 
the Military Money Order Division, Postal Data Center, P.0. Box 14965, St. 
Louis, MO 63182. A letter of transmittal that has the investigative case 
number, date of final report of investigation, offense, and complete 
identification or both subject and victim will be included. The letter 
will also state that information on the ROJ. If it is foreseen that 
postal money orders will be kept as evidence for more than 120 days from 
the date received by the evidence custodian, a first class letter will be 
sent immediately to the Military Money Order Division, Postal Data Center; 
it will list the serial number and symbol number of each money order and 
the reasons for retention. This may prevent the issue of duplicate money 
orders. 

(6) Negotiable instruments and other documents obtained from a person 
will be retuned, unless the owner does not want them. In this case, they 
will be destroyed. 

(7) Known document standards will be released to the agency or person from 
whom received or the rightful owner, unless they are not wanted. In this 

case, they will be destroyed. 

(8) Exemplars and other documents of no value to the person or agency from 
whom received will be destroyed. 

(9) Items of personal property that belong to deceased or missing Army 
personnel will be released to the summary court officer appointed to 
dispose of the descendent's effects. 

(10) Controlled substances will be destroyed in the presence of a witness 
who is a CID Special Agent or in the grade E-6 or above. The witness must 
not be involved in the chain of custody. Destruction will be by burning 
or by a method that will make it permanently useless. 

(11) Normally, counterfeit currency and coins, counterfeiting equipment 
will be released to the nearest office of the US Secret Service (USSS), 
unless the USSS directs otherwise. 

(12) Firearms and ammunition may be disposed of as follows: 

(a) U.S. government firearms and ammunition kept as evidence will be 
returned to the-proper military unit. If the unit cannot be 
identified, they will be released to the installation accountable 
officer, IAW paragraph 2-5, AR 710-2. 
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(b) Contraband firearms and ammunition kept as evidence will be 
released to the nearest office of Alcohol, Tobacco, and Firearms 
(ATF) Divisions, U.S. Treasury Department (18 USC 924d). This 
includes firearms and ammunition that were used or intended to be 
used in committing a crime. U.S. Government property is excluded. 

ATF Form 4631 (Request for Forfeiture), available at local ATF 
offices, must be filled out and sent to ATF along with a copy of the 
investigative report. 

When ATF does not accept such weapons, they will be released to the 
supporting DPDO for destruction, per DOD 4160.21-M and DOD 4160.21- 
M-l. ATFs refusal will be documented; this will be attached to the 
proper DA Form 4137. In all cases, the evidence custodian will 
witness the destruction of weapons at DPDO facilities. Ammunition 
refused by ATF will be released to the nearest ammunition supply 
point or depot. 

(c) In oversea areas, weapons described above will be turned in to 
the servicing DPDO. The DPDO will demilitarize them on a mutually 
agreed upon date. Ammunition described above will be turned in to 
the nearest ammunition supply point or depot. 

(d) Legal personal weapons impounded for minor infractions, (eg. 
failure to register per local laws), must be returned to the 
rightful owner when the requirements have been met and they are no 
longer needed as evidence. 

(13) When evidence is of obvious value and the owner is unknown or cannot 
be located, it will be turned in to the Defense Property Disposal Office 
(DPDO) per DOD 4160.21-M. 

(14) items of evidence found at crime scenes that have no known owner and 
are of no obvious value (eg. match books, beer cans, bottles, glass 
fragments, and wooden sticks) will be destroyed in the presence of a 
witness. Crushing, burning, or other methods will be used to render the 
items useless and harmless. 

(15) When the owner of the money is not known or cannot be located after 
reasonable attempts, the money will be turned in to a U.S. Army Finance 
Officer. A DD Form 1131 (Cash Collection Voucher) will be used. A copy 
of the DD Form 1131 will be attached to the original custody document. 

(16) Post exchange Items, commissary items, and items illegally Introduced 
into a host country, that are connected with black market, customs, and 

postal investigations, will be disposed of per— 

(a) Local regulations. 

(b) Status of forces agreements, and 

(c) Law or customs of the host country. 
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LESSON 3 


PRACTICE EXERCISE 

The following items will test your grasp of the material covered in this lesson. 
There is only one correct answer for each item. When you have completed the 
exercise, check your answers with the answer key that follows. If you answer any 
item incorrectly, study again that part of the lesson which contains the portion 
involved. 

1. You have a document containing cryptography, for which you do not have 

the key. What is your action? 

A. Attempt to decrypt the message. 

B. Process it in accordance with the unit standing operating procedures 
(SOP). 

C. Take it to the nearest cryptofacility for decryption. 

D. Forward it to the CCO. 


2 . 


What are the most common items of physical evidence encountered by Cl 
personnel? (Write in your answer) 


3. Which may reveal the sex, approximate height, and weight of an individual? 

A. Fingerprints. 

B. Footprints. 

C. Hair. 

4. If the items of evidence are small, is it permissible to consolidate the 
evidence from two or more investigations into one package to ship to the 
laboratory? 

A. Yes. 

C. No. 
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LESSON 3 


PRACTICE EXERCISE 
Answer Key and Feedback 
Item Correct Answer and Feedback 

1. B. Process it in accordance with the unit standing operating 

procedures. 

(page 3-2). 

2. Documents are the most common items of physical evidence encountered 
by Cl. (page 3-2). 

3. B. Footprints. (page 3-3). 

4. B. No. (page 3-15) . 
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APPENDIX A 


CRIME SCENE PROCESSING 

Successful crime scene processing depends upon the investigator's skill in recognizing and 
collecting items and facts that may be valuable as evidence. 

When processing a crime scene, the investigator must: 

* PROTECT the crime scene from destruction or contamination. 

* PRESERVE all items and facts of evidentiary value obtained at the crime scene. 
This includes making sketches and notes; photographing the scene; collecting 
trace evidence and fingerprints; questioning suspects, victims, and witnesses; and 
marking evidence. 

* PRESENT the findings made from crime scene processing. This is the purpose of 
protecting and preserving the crime scene. 

The investigator must attempt to reconstruct what actually occurred during the crime, and If 
testifying in court, be able to logically and positively identify all facts and items obtained during 
his investigation. The purpose of this appendix is to acquaint the investigator with- 

* Searching for collectable evidence. 

* Making investigative notes and sketches. 

* Photographing the crime scene. 

CRIME SCENE PROCEDURE. 

Initial Actions- 

Depending on the type of crime committed and the location, the crime scene is the area 
surrounding the location, to include all direct traces of the crime. The investigator should note 
the name and position of the person notifying him and the time the crime was reported. 

Upon arrival at the scene, the investigator should do the following: 

* Record the date, arrival time, and weather conditions. 

* If an injured person is on the scene, arrange for medical attention, identification, 
and removal. The scene is disturbed only to the extent necessary to have medical 
aid rendered to the injured or to have a doctor examine a deceased victim. 
Consideration should be given to providing a searched pathway to the victim. 

* If the offender is at the scene, apprehend him. 
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* If the scene is not fully protected, ensure its protection by using MP or other 
responsible persons to keep curious persons away from the scene and keep 
witnesses, suspects, and victims present from disturbing the scene. It may be 
necessary to reroute traffic or take other action to prevent any disturbance of the 
scene until a complete examination is made. 

Evidence . The body of a deceased victim should not be covered until thoroughly processed for 
evidence. Premature covering could result in destruction or alteration of valuable trace 
evidence. 

Immediate action is taken to protect items of possible evidentiary value that may be destroyed 
by rain, snow, fire, or other causes. For example, a raincoat or piece of canvas may be used to 
cover impressions in the earth that are exposed to rain. Wooden or paste board boxes may be 
placed over impressions in snow. Items that will melt must be shielded from the sun or other 
heat sources. Objects such as food and blood should be covered to protect them from 
contamination. 

Witnesses . Determine and record the names of persons at the scene who may be witnesses 
and separate them. These persons should be removed from the immediate area of the scene 
as soon as practicable. 

Conduct preliminary questioning of witnesses, suspects, and victims to determine in general the 
extent of the incident or crime. Record all movements made at the scene and what items 
persons have touched. 

Note the names of all persons present. Those present within the immediate area of the scene 
should be only the minimum needed to assist the investigator. It may be necessary to request 
military or other officials present to refrain from examining or disturbing objects or aspects of the 
scene. 

Investigating personnel must maintain CONTROL and SECURITY of the crime scene. 

RECORDING. 

The investigator begins the process of recording pertinent facts and details of the investigation 
the moment he arrives at the crime scene. 

He writes down identification of persons involved and what he initially sees. He also draws a 
rough sketch of the crime scene and takes an integrity photograph. This is accomplished to 
ensure that an image of the crime scene is recorded before the scene is disturbed. The 
recording continues for the duration of the crime scene processing. Techniques for recording 
sketches and investigative notes are discussed later. 

SEARCHING FOR EVIDENCE. 

Each crime scene is different, according to the physical nature of the scene and the crime 
involved. Consequently, the scene is processed to develop essential evidentiary facts pertinent 
to the offense. A general survey of the scene is always made, noting the location of obvious 
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to the offense. A general survey of the scene is always made, noting the location of obvious 
traces of the action, probable entry and exit point used by the offender(s), and the size and 
shape of the area involved. 

In rooms, buildings, and small outdoor areas, a systematic clockwise circle search for evidence 
is often initiated. (A counterclockwise or any other systematic movement may be just as 
effective in the search. However, in the interest of uniformity, it is recommended the clockwise 
movement be used). 



Figure A-1. Circle Search. 


The investigator examines each item encountered at the scene to locate anything that may be 
of evidentiary value. He should accomplish the following: 

* Give particular attention to fragile trace evidence that may be destroyed or altered 
if it is not collected immediately. 

* If any doubt exists as to the value of an item, treat it as evidence until proven 
otherwise. 

* Ensure each item or area where latent fingerprints may be present is closely 
examined and action taken to develop the prints. 

9 Carefully protect any impressions of evidentiary value in surfaces conducive to 
making casts or molds. Photograph the impression and make a cast or mold. 

* Note stains, spots, and pools of liquid within the scene and treat them as evidence. 
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* Note any peculiar odors emitting from the scene. 

* Treat as evidence all other items, such as hairs, fibers, and earth particles foreign. 
to the area in which they are found. This includes scrapings under the victim’s 
fingernails. (Small bags, used to cover the hands of deceased victims, would 
prevent loss or destruction of trace evidence.) 

* Continue systematically and uninterruptedly to the conclusion of the processing of 
the scene. The search for evidence is initially completed when, after a thorough 
examination of the scene, the rough sketch, necessary photographs, and 
investigative notes have been completed and the investigator has returned to the 
point from which the search began. Further search may be necessary after the 
evidence and the statements obtained have been evaluated. 

In large outdoor areas, it is advisable to divide the area into strips about 4 feet wide. The 
search starts at one end and moves back and forth across the area from one side to the other. 
A grid search takes place after a strip search is completed, it covers the area in a similar 
manner, but from end to end. 



END 
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Figure A-2. Strip Search and Grid Search. 


Indoor or outdoor areas may also be divided into zones or sectors, which are searched as 
individual areas (see two examples in Figure A-3). 
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It may be advisable to make a search beyond the area considered to be the immediate scene of 
the incident. If so, persons needed to accomplish the search may be secured from an MP or 
other available unit. 



All persons participating in the search must be thoroughly briefed as a minimum on the 
following points: 
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First: A full description of the item(s) being sought. 

Second: All information available as to how the item(s) may have been hidden or 
discarded. 

Third: The action to be taken when the item(s) is/are found. The searchers should be 
emphatically informed that when they discover an item believed to be the one being 
sought, or one similar, they should immediately notify the investigator in charge of the 
search, refrain from touching or moving the item and protect the area until the 
investigator arrives. 

After completing the search of the scene, the investigator examines the object or person 
actually attacked by the offender. For example, a ripped safe or desk drawer that has been 
opened would be processed after the remainder of the scene has been examined for traces of 
the offender. 

COLLECTING EVIDENCE 

Collecting evidence at a scene is usually accomplished after the search has been completed, 
rough sketch finished, and photographs taken, it may be advisable under certain conditions to 
collect various fragile items of evidence as they are found. Those items that would impede 
further search should be collected when they are located and depicted on the sketch. The 
essential factor is that evidence be carefully and properly collected. 

The investigator must handle evidence as little as possible. Rubber gloves may be used. See 
table 1 for recommended methods of handling specific items that may be collected at a scene. 
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Table I. Recommended Methods for Handling Crime Scene Item*. 


Items 

Method 

Handguns 

Use your fingers on the knurled grip. Do not 
touch smooth grips of smooth metal parts. Use the 
tip of the grips. Do not touch the magazine base of 
pistols. Place in a box bracing the weapons at the 
front and rear. 

Paper, money, documents, paper 

Use tweezers. Do not place tweezers over any 
obvious smudge. Place each item in a clean 
envelope or bag. 

Broken glass 

Use your fingers on the edges of larger pieces. Do 
not touch flat surfaces. Use tweezers on pieces 
too small for your fingers. Do not grasp at points 
of any obvious smudges. Wrap pieces individually 
in clean tissue, place in a rubbing box, and 
stabilize to prevent rubbing, shifting, or breakage. 

Dried stains on smooth surface 
furniture 

Collect portions of furniture bearing surfaces of 
of furniture stain in original patterns, if possible, 
otherwise, scrape with pocket knife or putty knife, 
removing as little of the finished surface as 
possible. 

Bottles, jars, drinking glasses 

Bullet 

Insert two or more fingers into large mouth 
vessels. Place the index fingers on the top and 
bottom of small mouth vessels. Do not 
contaminate or spill any substance in the vessel 
that may be of evidentiary value. 

Use your fingers or tweezers with taped ends. 

Avoid damage to rifling marks on the 
circumference. Place in a pillbox. 

Cartridge case 

Pick up at the open end with tweezers. Avoid 
scratching. Place in a pillbox. 

Dried stains on a floor 

Collect portion of floor bearing stain in original 
pattern, if possible; otherwise, remove by gouging 
deeper than the stain with putty knife, wood chisel, 
or other necessary tool. Place in pillbox or larger 
similar container. 


If the investigator touches a piece of evidence in a manner that leaves his fingerprints on the 
article, he indicates this fact in his notes and informs the laboratory personnel if they make an 
examination of the evidence. The investigator's and the victim’s fingerprint cards should be 
forwarded with latent prints to decrease delay of latent identification. 
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It may be necessary to damage, partially destroy, or otherwise decrease the effectiveness of an 
article to collect important evidence. For example, it may be necessary to cut the upholstery on 
a piece of furniture to obtain an area stained with blood or to cut out a section of a wall to collect 
fingerprints that cannot be collected by other means. Such action is based on the merits of the 
individual case. A door or window may be removed from a building to have it processed at a 
laboratory or held as evidence. 

The investigator should ensure necessary measures are taken to protect the contents of a 
building or room from which a door or window is removed. 

When collecting evidence at the scene for laboratory analysis, the amounts needed will depend 
upon the type of evidence and the test to be conducted. 

For proper evaluation of a stain by laboratory technicians, control samples should be submitted 
in addition to the collected stains. For example, a stain, soil, or porous surface is collected by 
dipping or gouging beneath the stain. Unstained portions are also collected and identified as 
control samples. The integrity of control samples is preserved as carefully as that of evidence. 

Marking Evidence for Identification. 

The investigator places his initials, date and time of discovery of each item of evidence, so it 
can be identified by him at a later date. These marks should be placed on the item of evidence 
as soon after discovery as is feasible and in a place least likely to affect the appearance, 
monetary, or evidentiary value of the item. Evidence that cannot be marked should be placed in 
a suitable dean container, sealed, and the identifying marks placed on the container. The 
investigator makes appropriate notes, to indude a description, in his notebook at the time the 
evidence is marked. 

In instances in which several items with the same appearance are coileded, the investigator 
places an identifying number on each item and indicates, by that number, in his notes and on 
the sketch where each item was found. 

If a bullet, a knife, or other item on which the investigator would normally place his initials 
cannot be marked in the recommended manner, the item is placed in a suitable container and 
the container is marked for identification. 

Additional information on marking evidence can be found in lesson 3 of this subcourse. 

GENERAL EVIDENCE PROCESSING. 

Ta gging evidence . Physical evidence the investigator obtains must be tagged prior to its 
submission to the evidence custodian. This action should take place at the scene of the crime 
when the evidence is collected, at the place of receipt, or as soon thereafter as possible. The 
tag serves as an aid in the processing and storage of evidence (see lesson 3). 

Evaluating evidence . Frequently, the successful conclusion of an investigation depends on an 
accurate evaluation of the evidence. Each item of evidence must be evaluated in relation to all 
other evidence, individually and collectively. 
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The investigator's evaluation of evidence begins with the first information received concerning 
the incident or crime and continues until the investigation has been satisfactorily concluded or 
discontinued by proper authority. The evaluation may include a discussion of the evidence with 
supervisors, other investigators, laboratory technicians, or other experts in a given field. 

Preserving evidence , it is the investigator's responsibility to ensure every precaution is 
exercised to preserve physical evidence in the state in which it was received until it is released 
to the evidence custodian. 

Preservation includes security and chain of custody. A key-type field safe should be made 
available to the investigator for temporary storage of evidence during other than normal duty 
hours (see lesson 3). 

Releasing evidence . Once in the investigator's possession, evidence is released only to the 
evidence custodian or another person designated by the investigator's supervisor. 

Releasing the scene . The scene is not released until all processing has been completed. The 
release should be affected at the earliest practicable time, particularly in instances in which an 
activity has been closed or its operations curtailed. 

Sketches and Investigative Notes . 

Property prepared sketches may be used to question witnesses, suspects, and victims; to 
prepare a report of investigation; and to present information in court. 

They are also valuable sources of information for both trial and defense counsels. Sketches 
are frequently introduced in court as evidence and used to acquaint the court with crime scenes 
and help witnesses orient themselves as they testily. Sketches and notes made during an 
investigation become DA property and are not retained or used as personal property. 

Notes or sketches used to refresh the investigator's memory during a court appearance may be 
reviewed by the court. Appropriate attention is given to ensure all notes and sketches are 
legible and project dear, meaningful facts. Lack of organization in notes or sketches could 
adversely influence the weight given to the investigator’s testimony by a court. 

Sketches. A sketch which graphically portrays the scene of a crime and items within the crime 
scene is of interest to the investigation. The sketch, crime scene photographs, and 
investigative notes are complementary and necessary to effectively process the crime scene. 

The sketch provides the best means of portraying distances between objects at the scene. 
There are two basic kinds of sketches, the rough sketch and the smooth sketch (scaled 
drawing). Both types of sketches contain the same general information, but differ according to 
the technique of presenting the information. 

To cover items of interest to the investigation, crime scene sketches must, as a minimum, depict 
the following: 

* Locations of approaches, such as roadways, paths, entrances, exists, windows, 
and skylights. 
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* Size of the area or building. 

* Exact locations and relative positions of all pertinent evidence found at the scene. 

* Camera locations. 

In depicting the above, the sketch should: 

* Each sketch should have a caption to identify the illustration, (eg. "Rough 
sketch showing camera positions and distances.)" 

* Reflect accurate measurements verified by another person. 

* indicate compass direction of north. (Located on top of the scale bar) 

* Designate the scale (for scaled drawing only). If no scale is used, state this fact. 
(Located in bottom center) 

* Use a conventional system of measurement (English or metric system). Paces or 
steps are not used. 

* Must contain a legend located in lower left position that explains all symbols or 
letters used to identify objects on the sketch. Military symbols are used where 
practicable. 

* Each sketch must have a sketch title block, located in the lower right portion that 
depicts the report or incident number, offense alleged, name and rank or title of the 
victim, scene (portrayed - citing room number, bldg number, and type of building, 
location (citing complete name of installation, city, state, zip code, date and time 
the sketch was started, and the name and rank or title of the persons who made 
and verified the sketch. 

Rough sketch. The purpose of a rough sketch is to portray information accurately, not 
necessary artistically. A rough sketch is usually not drawn to scale. But it must show accurate 
distances, dimensions, and relative proportions. The rough sketch is filed with the copy of the 
report retained by the originating office. 

More than one sketch can be made of a particular scene. One may reflect measurements; 
another camera positions; and a third may be required to show locations of items of physical 
evidence at the scene. In some instances, separate sketches may be the best way to record 
multiple scenes contained within a larger area of investigative interest, or to provide detailed 
depictions of isolated locations within a relatively small crime scene. Conditions may 
necessitate the sketching of a limited area within the crime scene. 
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LEGEND 


TITLE 


(X): CROWBAR 

j^( MOT TC 

k 


ROI (OR MRR) # (HELD SAFE) 

HOUSEBREAKING 0800 l FEB 12 

RM#4 BLOG 3972 
FT. BLANK, AL $ 

DRAWN BY: S.A. SMITH 

VERIFIED BY CPT JAMES WALTERS 


Figure A-4. Rough Sketch, Showing Evidence 
Measurements and Triangulation. 


A-11 


IT 0735 






SAFE 




TITLE: 

ROI (OR MPR) # 

Housebreaking, RM # 4, Bldg 3972 
Ft. Blank, AL 

DRAWN BY: CW3 Albert French 
VERIFIED BY: _ 

Figure A-5. Smooth Sketch. 


LEGEND: 

-Crowbar 

MOT TO SOALO 

Finished Sketch 
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Items necessary to prepare a rough sketch are as follows: 

* Soft lead pencil. 

* Bond paper or graph paper. 

* Several thumbtacks to hold one end of the steel tape down when you’re working 
alone. 

* Clipboard large enough to form a back for the paper. 

* Steel tape (at least 100 feet long). 

* A straightedge ruler. 

* A magnetic compass. 

Smooth sketch . A smooth finished sketch is a more finished version of a rough sketch, using 
the information provided in the rough sketch. A smooth sketch need not be drawn by the same 
person who draws the rough sketch. But whoever draws the rough sketch must verify the 
accuracy of the smooth sketch if made by an experienced draftsman. When drawn to scale, the 
sketch need not include figures to show distances. If not drawn to scale, this fact should be 
indicated on the sketch and distances should be shown as on a rough sketch. A copy of the 
finished sketch is appended to each copy of the investigative report. 

If the finished sketch is prepared by investigative unit personnel, the following materials are 
considered necessary: 

* Drawing board or table. 

* Draftsman T-square. 

* Pencil and ink drawing compass. 

* Ink ruling pen. 

* Lettering and drawing pens. 

* Black india ink. 

* Drawing and tracing paper. 

* Architect scale. 

* Art gum and ink erasers. 

* Engineer or architect triangles. 
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* Drawing pencil. 

* French curve. 

Pro jection Sketch . A cross-projection sketch may be used to add another dimension to 
sketches. It is useful when items or locations of interests are on or in wall surfaces in an 
enclosed space. The walls, windows, and doors in a cross-projection sketch are drawn as 
though the walls had been folded out flat on the floor (see Fig A-6). 

Methods to Establish Location and Measurement . 

Various sketch methods may be used to locate evidence and other important items at the 
scene. The simplest form of a sketch is a two-dimensional presentation of a scene as viewed 
directly from above. Evidence is located on this type of sketch by triangulation. Triangulation is 
used for indoor and outdoor sketches having fixed reference points. Objects are located by 
creating, a triangle of measurements from a single, specific, identifiable point on an object to 
two fixed points, all on the same plane, at the scene. If movable items are to be used as 
reference points, they must first be “fixed'' themselves. Do not triangulate evidence to 
evidence. Do not triangulate under or through evidence. Do not take a line of measurement 
through space. Measure your line along walls, or table top: In the interest of clarity, keep the 
angle of triangulation measurement between 45 and 90 degree on the sketches. 

Regulator shaped items are fixed by creating two separate triangles of measurements. Each 
originates at opposite points on the object and ends at two fixed points, in the same plane, at 
the scene. 

Pliable objects are fixed by creating a single triangle of measurement from the center of mass of 
the object to two fixed points, on the same plane, at the scene. You also measure the longest 
and widest dimension of the object. 

Inhibited outdoor areas usually have easily defined, fixed reference points such as buildings, 
edges of roads, and sidewalks. When these are present, the triangulation method can be used 
to establish the location of objects. But uninhabited or remote areas may not have easily 
defined, fixed points will have to be located by using the intersection-resection method taught in 
map reading. See FM 21-26 for more discussion on intersection-resection. 

INVESTIGATIVE NOTES. 

Investigative notes are prepared for use in recalling places, events, incidents or other pertinent 
facts. They are filed with the copy of the report retained by the originating office. 

Basic Principles of note taking are: 

* Notes should be printed or made in legible handwriting, preferably in ink. The ink 
should not smudge easily. 

* Each page of notes should be identified with the investigator’s name, the case 
number (when known), and the date. 
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* Short phrases should be used; single words or shorthand notes may not be 
meaningful at a later date or to other persons. 

* The first notes recorded after a complaint is received should include the date and time 
the complaint or information was received, name of the person reporting the 
information, names of the accused or suspected person(s), exact location of the 
incident, and a brief account of the details received. A complete identity of each 
person should be recorded when he is first mentioned. 

Notes should be made when an action is taken, when information is received, and when an 
event is observed. However, the investigator should not allow his note taking to adversely 
affect the questioning of a person who may be distracted by such action and subsequently 
withhold information. 

Notes should indicate a detailed description of any item considered to be pertinent to the 
investigation. This includes: 

* Unusual or peculiar marks of identification. 

* The exact location where the item was found and the relative distances separating 
various items. 

* Trade names, and serial and model numbers. 

' The recording of all identifying marks placed on the item. 

Notes should indicate action taken by the investigator that may have a bearing on evidence 
obtained or significantly affect the investigation. 

Notes should identify each photograph taken of a scene. They should be accurate and 
complete, since they form the basis for the preparation of the formal investigative report. The 
investigator may also use the notes to refresh his memory if he appears as a witness in a court 
proceeding. 

Notes should not be edited or erased. If a mistake is made, the entry should be lined out, 
initialed, and then rewritten. 

Crime Scene Photography . 

One of the most valuable aids to a criminal investigation is provided by photographs. When 
properly taken, photographs supplement notes and sketches, clarify written reports, provide 
identification of personnel, and provide a permanent record of fragile perishable evidence. 

The most important rule in crime scene photography is to photograph all evidence or possible 
evidence before anything is moved or touched. 

General Considerations . Maintaining perspective is the most important consideration in crime 
scene photography. Photographs that nearly duplicate the exact scene with respect to scope, 
position, color, and form are the most useful. 
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Time is also an important consideration. Fragile trace evidence subject to nature (such as a 
footprint in the rain and fingerprints) should be photographed prior to any other processing. 

There should not be any extraneous objects in the photographs such as investigators, their 
clothing, or equipment. Notes should be taken of the type of camera and film used, 
photographs taken, and any information necessary for the photographers to be able to answer 
"Yes" to the question, "Does this photograph represent the scene as you saw it?" 

If it has been determined an explosive was used and there is residue of explosives in the area, 
a flash attachment should not be used. 

When necessary, all objects should be photographed from different angles to ensure complete 
coverage. Evidence flags are useful in marking the location of small items of evidence for a 
photograph. 



A piece of cloth, preferably white, 
large enough to be in a photograph. 



Wire, stiff enough to hold 
cloth in position for 
photograph. 


Completed evidence glag. 


Rgure A-7. Evidence Rag. 


When pertinent, photographs should be taken of the general scene, approaches to the crime 
scene, surrounding areas, closeups of the entrance and exit locations, or those routes most 
likely used. 

Special Considerations . 

Arson scenes . There are several special considerations in photographing a fire. The 
photographer should seek out various possible angles from which to take photographs, 
attempting to keep out of smoke-filled areas. 
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Photographs of the entire structure should be made first. Color film should be used to show the 
color of the smoke, flames, and vapors. A series of photographs taken at intervals of several 
minutes may show the intensity and direction of the fire. Photographs should be made of any 
spectators at a fire, because the perpetrator may be present watching the results of his efforts. 

After the fire, the entire exterior of the structure should be photographed. Following this, all 
affected interior areas should be photographed, to include any evidence discovered. 

Suspected points of origin should be photographed in detail. Since the photographer cannot 
rely on his exposure meter when trying to photograph charred wood, two or three stops 
overexposure will be required. 


ARSON: DURING FIRE 
o Various angles 

o Color photo of entire structure first (include 
smoke, flames, and vapor) 

o Series taken at intervals of several minutes 

o Spectators 

ARSON: AFTER FIRE 
o Entire exterior 
o Affected interior areas 
o All evidence 
o Suspected points of origin 



Figure A-8. Photographing the Arson Scene. 

Other evidence . Various Items of evidence should be specifically photographed. This evidence 
should normally be located in an overall view of the crime scene. Next, a medium-range shot 
should be taken of the object to show its surrounding area. A third, doseup shot of the object 
should be made to show any peculiarities, followed by the same shot with a ruler in the picture 
area. 
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crime scene, surrounding areas, closeups of the entrance and exit locations, or those 
routes most likely used. 

Special Considerations . 

Arson scenes . There are several special considerations in photographing a fire. The 
photographer should seek out various possible angles from which to take 
photographs, attempting to keep out of smoke-filled areas. 

Photographs of the entire structure should be made first. Color film should be used to 
show the color of the smoke, flames, and vapors. A series of photographs taken at 
intervals of several minutes may show the intensity and direction of the fire. 
Photographs should be made of any spectators at a fire, because the perpetrator may 
be present watching the results of his efforts. 

After the fire, the entire exterior of the structure should be photographed. Following 
this, all affected interior areas should be photographed, to include any evidence 
discovered. Suspected points of origin should be photographed in detail. Since the 
photographer cannot rely on his exposure meter when trying to photograph charred 
wood, two or three stops overexposure will be required. 
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APPENDIX C 


APO 

ATF 

BW 

CBW 

CCF 

Cl 

Cll 

CIDC 

CINCUSAREUR 

CONUS 

CW 

DCSINT, DA 

DIS 

DPDO 

EUSA 

EW 

FBI 

INSCOM 

ISEW 

MACOM 

MP 

MPRJ 

MPR 

NBC 

NCIS 

ODCSINT 

OSI, IG 

PSI 

SCI 

SJA 

SOP 

UCMJ 

USACIL 

USAIRR 

USAREUR 

USSS 


ACRONYMS 


Army Post Office 

Alcohol, Tobacco, and Firearms Division 

Biological Warfare 

Chemical, Biological Warfare 

Central Personnel Security Clearance Facility 

Counterintelligence 

Counterintelligence Investigation 

Criminal Investigation Division Command 

Commander in Chief, United States Army, Europe 

Continental United States 

Chemical Warfare 

Deputy Chief of Staff for Intelligence, Department of the Army 

Defense Investigative Service 

Defense Property Disposal Office 

Eighth US Army 

Electronic Warfare 

Federal Bureau of Investigation 

Foreign Counterintelligence Activity 

Intelligence and Security Command 

Intelligence, Security, and Electronic Warfare 

Major Army Command 

Military Police 

Military Personnel Records Jacket 

Military Police Report 

Nuclear, Biological, and Chemical 

Naval Criminal Investigative Service 

Office of the Deputy Chief of Staff for Intelligence 

Office of Special Investigations, Inspector General 

Personnel Security Investigation 

Sensitive Compartmented Information 

Staff Judge Advocate 

Standing Operating Procedures 

Uniform Code of Military Justice 

US Army Criminal Investigation Laboratory 

US Army Intelligence Records Repository 

United States Army, Europe 

US Secret Service 
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